Insecure digital certificates In curl
Description
When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 debian 12 | =7.88.1-10 || =7.88.1-10+deb12u1 || =7.88.1-10+deb12u11 || =7.88.1-10+deb12u12 || =7.88.1-10+deb12u13 || =7.88.1-10+deb12u14 || =7.88.1-10+deb12u15 || =7.88.1-10+deb12u1~bpo11+1 || =7.88.1-10+deb12u2 || =7.88.1-10+deb12u3 || =7.88.1-10+deb12u3~bpo11+1 || =7.88.1-10+deb12u4 || =7.88.1-10+deb12u5 || =7.88.1-10+deb12u5~bpo11+1 || =7.88.1-10+deb12u6 || =7.88.1-10+deb12u6~bpo11+1 || =7.88.1-10+deb12u7 || =7.88.1-10+deb12u8 || =7.88.1-10+deb12u9 || =7.88.1-11 || =8.0.1-1~exp1 || =8.10.0-1 || =8.10.0-2 || =8.10.1-1 || =8.10.1-1~bpo12+1 || =8.10.1-2 || =8.11.0-1 || =8.11.1-1 || =8.11.1-1~bpo12+1 || =8.12.0+git20250209.89ed161+ds-1 || =8.12.0+git20250209.89ed161+ds-1~bpo12+1 || =8.12.1-1 || =8.12.1-2 || =8.12.1-2~bpo12+1 || =8.12.1-3 || =8.12.1-3~bpo12+1 || =8.13.0-1 || =8.13.0-1+exp1 || =8.13.0-2 || =8.13.0-2+exp1 || =8.13.0-3 || =8.13.0-4 || =8.13.0-4+exp1 || =8.13.0-5 || =8.13.0-5+exp1 || =8.13.0-5~bpo12+1 || =8.13.0~rc-1~exp1 || =8.13.0~rc-1~exp2 || =8.13.0~rc2-1 || =8.13.0~rc2-2 || =8.13.0~rc3-1 || =8.13.0~rc3-1+exp1 || =8.14.0-1 || =8.14.0-1+exp1 || =8.14.0~rc1-1+exp1 || =8.14.0~rc2-1+exp1 || =8.14.0~rc3-1+exp1 || =8.14.1-1 || =8.14.1-1~bpo12+1 || =8.14.1-2 || =8.14.1-2+exp1 || =8.14.1-2~bpo12+1 || =8.15.0-1 || =8.15.0-1~bpo13+1 || =8.15.0-1~exp1 || =8.15.0~rc1-1exp1 || =8.15.0~rc2-1~exp1 || =8.15.0~rc3-1~exp1 || =8.16.0-1 || =8.16.0-1+exp1 || =8.16.0-1~bpo13+1 || =8.16.0-2 || =8.16.0-3 || =8.16.0-4 || =8.16.0-4~bpo13+1 || =8.16.0~rc1-1~exp1 || =8.16.0~rc2-1 || =8.16.0~rc2-2 || =8.16.0~rc3-1 || =8.17.0-1 || =8.17.0-2 || =8.17.0-3 || =8.17.0~rc1-1~exp1 || =8.17.0~rc2-1 || =8.17.0~rc3-1 || =8.18.0-1 || =8.18.0-1~bpo13+1 || =8.18.0-2 || =8.18.0~rc1-1+exp1 || =8.18.0~rc2-1 || =8.18.0~rc3-1 || =8.19.0-1 || =8.19.0-1+exp1 || =8.19.0-1~bpo13+1 || =8.19.0-2 || =8.19.0-3 || =8.19.0-3+exp1 || =8.19.0-3+exp2 || =8.19.0~rc1-1~exp1 || =8.19.0~rc2-1 || =8.19.0~rc2-2 || =8.19.0~rc3-1 || =8.2.1-1 || =8.2.1-2 || =8.2.1-2~bpo12+1 || =8.20.0-1 || =8.20.0-1+exp || =8.20.0-2 || =8.20.0-2+exp1 || =8.20.0-2~bpo13+1 || =8.20.0-3 || =8.20.0-4 || =8.20.0-5 || =8.20.0-5~bpo13+1 || =8.20.0~rc1-1+exp1 || =8.20.0~rc1-1+exp2 || =8.20.0~rc1-1+exp3 || =8.20.0~rc2-1 || =8.20.0~rc2-1+exp1 || =8.20.0~rc3-1 || =8.20.0~rc3-1+exp1 || =8.21.0-1 || =8.21.0-1+exp1 || =8.21.0-2 || =8.21.0-2+exp1 || =8.21.0-2~bpo13+1 || =8.21.0~rc1-1+exp1 || =8.21.0~rc2-1 || =8.21.0~rc2-1+exp1 || =8.21.0~rc3-1 || =8.21.0~rc3-1+exp1 || =8.22.0-1 || =8.22.0-1+exp1 || =8.22.0~rc2-1 || =8.22.0~rc2-2 || =8.22.0~rc3-1 || =8.22.0~rc3-1+exp1 || =8.23.0~rc1-1 || =8.23.0~rc1-2 || =8.23.0~rc2-1 || =8.23.0~rc2-1+exp1 || =8.3.0-1 || =8.3.0-2 || =8.3.0-2~bpo12+1 || =8.3.0-2~exp1 || =8.3.0-3 || =8.4.0-1 || =8.4.0-2 || =8.4.0-2~bpo12+1 || =8.5.0-1 || =8.5.0-1+exp1 || =8.5.0-2 || =8.5.0-2+exp1 || =8.5.0-2~bpo12+1 || =8.6.0-1 || =8.6.0-1.1 || =8.6.0-2 || =8.6.0-3 || =8.6.0-3.1 || =8.6.0-3.1~exp1 || =8.6.0-3.1~exp2 || =8.6.0-3.2 || =8.6.0-4 || =8.7.1-1 || =8.7.1-1+exp1 || =8.7.1-2 || =8.7.1-3 || =8.7.1-4 || =8.7.1-5 || =8.7.1-5+exp1 || =8.7.1-5~bpo12+1 || =8.8.0-1 || =8.8.0-1+exp1 || =8.8.0-1+exp2 || =8.8.0-1~bpo12+1 || =8.8.0-2 || =8.8.0-3 || =8.8.0-4 || =8.9.0-1 || =8.9.0-2 || =8.9.0-3 || =8.9.1-1 || =8.9.1-2 || =8.9.1-2~bpo12+1 | - | |
debian 14 | =8.14.1-2 || =8.14.1-2+exp1 || =8.15.0-1 || =8.15.0-1~bpo13+1 || =8.15.0-1~exp1 || =8.15.0~rc1-1exp1 || =8.15.0~rc2-1~exp1 || =8.15.0~rc3-1~exp1 || =8.16.0-1 || =8.16.0-1+exp1 || =8.16.0-1~bpo13+1 || =8.16.0-2 || =8.16.0-3 || =8.16.0-4 || =8.16.0-4~bpo13+1 || =8.16.0~rc1-1~exp1 || =8.16.0~rc2-1 || =8.16.0~rc2-2 || =8.16.0~rc3-1 || =8.17.0-1 || =8.17.0-2 || =8.17.0-3 || =8.17.0~rc1-1~exp1 || =8.17.0~rc2-1 || =8.17.0~rc3-1 || =8.18.0-1 || =8.18.0-1~bpo13+1 || =8.18.0-2 || =8.18.0~rc1-1+exp1 || =8.18.0~rc2-1 || =8.18.0~rc3-1 || =8.19.0-1 || =8.19.0-1+exp1 || =8.19.0-1~bpo13+1 || =8.19.0-2 || =8.19.0-3 || =8.19.0-3+exp1 || =8.19.0-3+exp2 || =8.19.0~rc1-1~exp1 || =8.19.0~rc2-1 || =8.19.0~rc2-2 || =8.19.0~rc3-1 || =8.20.0-1 || =8.20.0-1+exp || =8.20.0-2 || =8.20.0-2+exp1 || =8.20.0-2~bpo13+1 || =8.20.0-3 || =8.20.0-4 || =8.20.0-5 || =8.20.0-5~bpo13+1 || =8.20.0~rc1-1+exp1 || =8.20.0~rc1-1+exp2 || =8.20.0~rc1-1+exp3 || =8.20.0~rc2-1 || =8.20.0~rc2-1+exp1 || =8.20.0~rc3-1 || =8.20.0~rc3-1+exp1 || =8.21.0-1 || =8.21.0-1+exp1 || =8.21.0-2 || =8.21.0-2+exp1 || =8.21.0-2~bpo13+1 || =8.21.0~rc1-1+exp1 || =8.21.0~rc2-1 || =8.21.0~rc2-1+exp1 || =8.21.0~rc3-1 || =8.21.0~rc3-1+exp1 || =8.22.0~rc2-1 || =8.22.0~rc2-2 || >=0 <8.22.0~rc3-1 | 8.22.0~rc3-1 | |
debian 13 | =8.14.1-2 || =8.14.1-2+deb13u1 || =8.14.1-2+deb13u2 || =8.14.1-2+deb13u2~bpo13+1 || =8.14.1-2+deb13u3 || =8.14.1-2+deb13u4 || =8.14.1-2+deb13u5 || =8.14.1-2+exp1 || =8.15.0-1 || =8.15.0-1~bpo13+1 || =8.15.0-1~exp1 || =8.15.0~rc1-1exp1 || =8.15.0~rc2-1~exp1 || =8.15.0~rc3-1~exp1 || =8.16.0-1 || =8.16.0-1+exp1 || =8.16.0-1~bpo13+1 || =8.16.0-2 || =8.16.0-3 || =8.16.0-4 || =8.16.0-4~bpo13+1 || =8.16.0~rc1-1~exp1 || =8.16.0~rc2-1 || =8.16.0~rc2-2 || =8.16.0~rc3-1 || =8.17.0-1 || =8.17.0-2 || =8.17.0-3 || =8.17.0~rc1-1~exp1 || =8.17.0~rc2-1 || =8.17.0~rc3-1 || =8.18.0-1 || =8.18.0-1~bpo13+1 || =8.18.0-2 || =8.18.0~rc1-1+exp1 || =8.18.0~rc2-1 || =8.18.0~rc3-1 || =8.19.0-1 || =8.19.0-1+exp1 || =8.19.0-1~bpo13+1 || =8.19.0-2 || =8.19.0-3 || =8.19.0-3+exp1 || =8.19.0-3+exp2 || =8.19.0~rc1-1~exp1 || =8.19.0~rc2-1 || =8.19.0~rc2-2 || =8.19.0~rc3-1 || =8.20.0-1 || =8.20.0-1+exp || =8.20.0-2 || =8.20.0-2+exp1 || =8.20.0-2~bpo13+1 || =8.20.0-3 || =8.20.0-4 || =8.20.0-5 || =8.20.0-5~bpo13+1 || =8.20.0~rc1-1+exp1 || =8.20.0~rc1-1+exp2 || =8.20.0~rc1-1+exp3 || =8.20.0~rc2-1 || =8.20.0~rc2-1+exp1 || =8.20.0~rc3-1 || =8.20.0~rc3-1+exp1 || =8.21.0-1 || =8.21.0-1+exp1 || =8.21.0-2 || =8.21.0-2+exp1 || =8.21.0-2~bpo13+1 || =8.21.0~rc1-1+exp1 || =8.21.0~rc2-1 || =8.21.0~rc2-1+exp1 || =8.21.0~rc3-1 || =8.21.0~rc3-1+exp1 || =8.22.0-1 || =8.22.0-1+exp1 || =8.22.0~rc2-1 || =8.22.0~rc2-2 || =8.22.0~rc3-1 || =8.22.0~rc3-1+exp1 || =8.23.0~rc1-1 || =8.23.0~rc1-2 || =8.23.0~rc2-1 || =8.23.0~rc2-1+exp1 | - | |
 alpine v3.23 | >=7.45.0 <8.22.0-r0 | 8.22.0-r0 | |
alpine v3.24 | >=7.45.0 <8.22.0-r0 | 8.22.0-r0 | |
 rpm rhel9 | - | - | |
rpm rhel10 | - | - | |
rpm rhel8 | - | - |
Does your application use this vulnerable software?
During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.