Skip to content
OpenAdvisories
High ALAS2023-2026-3128 1 CVE

Important: curl security update (Amazon Linux 2023)

Published Sep 28, 2026 · Updated Sep 28, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-80230: When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2023 curl 0:8.21.0-5.amzn2023.0.2
Amazon Linux · 2023 curl-debuginfo 0:8.21.0-5.amzn2023.0.2
Amazon Linux · 2023 curl-debugsource 0:8.21.0-5.amzn2023.0.2
Amazon Linux · 2023 curl-minimal 0:8.21.0-5.amzn2023.0.2
Amazon Linux · 2023 curl-minimal-debuginfo 0:8.21.0-5.amzn2023.0.2
Amazon Linux · 2023 libcurl 0:8.21.0-5.amzn2023.0.2
Amazon Linux · 2023 libcurl-debuginfo 0:8.21.0-5.amzn2023.0.2
Amazon Linux · 2023 libcurl-devel 0:8.21.0-5.amzn2023.0.2
Amazon Linux · 2023 libcurl-minimal 0:8.21.0-5.amzn2023.0.2
Amazon Linux · 2023 libcurl-minimal-debuginfo 0:8.21.0-5.amzn2023.0.2

Vulnerabilities 1

  • High 7.5
    CVE-2026-80230

    OpenSSL pinning bypass

    When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented …

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-80230.html