Description
When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`
with the curl tool, curl should check the public key of the server certificate
to verify the peer.
This check was skipped in a certain condition that would then make curl allow
the connection without performing the proper check, thus not noticing a
possible impostor. To skip this check, the connection had to be done with QUIC
with ngtcp2 built to use GnuTLS and the user had to explicitly disable the
standard certificate verification.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| curl | curl | 8.8.0 – < 8.14.2, 8.15.0 – < 8.16.1, 8.17.0 – < 8.18.0, 8.17.0, 8.16.0, 8.15.0, 8.14.1, 8.14.0, 8.13.0, 8.12.1, 8.12.0, 8.11.1, 8.11.0, 8.10.1, 8.10.0, 8.9.1, 8.9.0, 8.8.0 | 8.14.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | curl | 8.18.0~rc2-1 | — |
| Debian 13 | curl | 8.14.1-2+deb13u3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | curl | 8.14.1-2ubuntu1.1 | USN-8062-1 |
| Ubuntu 24.04 LTS | curl | 8.5.0-2ubuntu10.7 | USN-8062-1 |
| Ubuntu 22.04 LTS | curl | 7.81.0-1ubuntu1.22 | USN-8062-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | curl +3 | 8.19.0-3.hum1 | RHSA-2026:6893 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.22 | curl | 8.14.1-r4 | — |
| Alpine v3.21 | curl | 8.14.1-r3 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | curl +4 | 8.17.0-1.amzn2023.0.1 | ALAS2023-2026-1375 |
Advisories 4
- WID-SEC-2026-0030 cURL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- RHSA-2026:6893 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- USN-8062-1 curl vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- ALAS2023-2026-1375 Moderate: curl security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 20, 2026