ALPINE-CVE-2026-80230
ALPINE-CVE-2026-80230
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.
CVSS 7.5 · Élevée · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: system