curl 8.22 Fixes an OpenSSL Public-Key Pinning Bypass

The curl project published CVE-2026-80230 with curl 8.22.0 on September 2, 2026. The low-severity issue affects libcurl builds using OpenSSL or a compatible fork when public-key pinning is configured together with both standard peer and hostname verification disabled.

Under an additional abnormal condition—an established connection without a presented server certificate—libcurl could skip the pinning check and allow an unauthenticated connection to succeed. curl 8.22.0 contains the fix.

The trigger is narrow, but the operational lesson is broad: a pin is an additional identity check, not a safe replacement for standard certificate validation.

What is affected

The official advisory identifies these conditions:

• libcurl uses OpenSSL or a fork such as BoringSSL, AWS-LC, LibreSSL, or QuicTLS;
• CURLOPT_PINNEDPUBLICKEY is configured;
• CURLOPT_SSL_VERIFYPEER is set to zero;
• CURLOPT_SSL_VERIFYHOST is set to zero;
• the connection proceeds without a server certificate being presented;
• the affected curl version is 7.45.0 through 8.21.0.

The issue also affects the curl command-line tool when the same effective conditions are created. curl versions at or above 8.22.0 are not affected by this flaw.

What this advisory does not mean

It does not mean that every pinned-key connection in curl is broken. It does not describe ordinary CA validation with peer and hostname verification enabled. It also does not justify disabling verification while waiting for an upgrade.

Avoid overbroad emergency changes. First identify the TLS backend, curl version, and effective verification flags for the affected workload.

Why proxy operators should check both TLS hops

An HTTPS proxy can create two separate certificate-validation contexts:

1. the TLS connection from the client to the proxy;
2. the TLS connection through the proxy to the destination.

Inventory pinning and verification independently for both hops. The relevant option names and behavior differ between proxy TLS and origin TLS. A correct destination policy does not prove that the proxy hop is equally strict, and vice versa.

For plain HTTP proxies carrying CONNECT tunnels, the proxy hop itself is not TLS, but the tunneled destination still needs normal certificate and hostname validation.

Immediate response plan

1. Record the exact curl and libcurl versions deployed.
2. Record the TLS backend for each build, not only the package name.
3. Search configuration for public-key pinning and disabled peer or hostname checks.
4. Separate proxy-hop options from destination-hop options.
5. Upgrade affected systems to curl 8.22.0 or a vendor build containing the fix.
6. Restore standard peer and hostname verification wherever it was disabled.
7. Run positive and negative pinning tests before broad rollout.
8. Drain old processes or connection pools after the patched build starts.

If an application cannot be upgraded immediately, do not treat pinning alone as a mitigation. Re-enable standard verification and follow the vendor-supported patch process.

Build a useful pinning regression test

Use an endpoint and certificates you control. Never run certificate-manipulation tests against third-party systems.

Your fixture should include:

• a valid chain, matching hostname, and matching public-key pin;
• a valid chain and hostname with a deliberately wrong pin;
• a certificate from an untrusted test CA;
• a hostname mismatch;
• an expired test certificate;
• an approved certificate rotation with old and new pins during the overlap window.

The expected outcomes are deterministic. Only the approved combinations succeed. Wrong pins, untrusted chains, hostname mismatches, and expired certificates must fail closed.

Test the effective configuration, not only source code

Security flags can come from environment variables, wrappers, templates, command-line construction, or fallback code. Capture the final effective policy at runtime without logging secrets.

For each test, record:

• curl version and TLS backend;
• proxy endpoint label and origin endpoint label;
• peer-verification and hostname-verification booleans;
• pin-set identifier and rotation version;
• fresh or reused connection status;
• certificate-validation result category;
• retry count and final route.

Do not log passwords, tokens, complete proxy URLs, private keys, or raw pin material. A non-secret pin-set ID is sufficient for correlation.

Avoid unsafe fallback behavior

Certificate failures must not trigger a weaker route or weaker TLS policy.

• Never change verification flags after a failure.
• Never remove the pin and retry automatically.
• Never fall back to direct access unless policy explicitly authorizes it.
• Do not rotate residential proxy endpoints indefinitely after a deterministic TLS policy error.
• Keep certificate failures separate from proxy-capacity or timeout metrics.

Use Proxy Bypass Audit to find unintended direct routes and TLS Trust Profile Isolation to partition connection pools by effective policy.

Plan certificate rotation correctly

Public-key pinning can cause outages if a certificate changes without an overlap plan. Maintain at least one active pin and one approved next pin during rotation. Version the pin set, deploy it before the certificate change, verify both keys in a controlled environment, and remove the retired pin only after rollback risk has passed.

Pins should be owned, reviewed, and monitored like credentials. Use Proxy Credential Rotation to coordinate secrets and trust-material changes without coupling them unnecessarily.

Upgrade acceptance checklist

• All deployed curl versions and TLS backends are inventoried.
• Affected builds are upgraded or vendor-patched.
• Peer and hostname verification are enabled.
• Proxy-hop and origin-hop policies are reviewed separately.
• Matching-pin tests succeed.
• Wrong-pin, wrong-CA, hostname-mismatch, and expired-certificate tests fail.
• Connection reuse does not carry an obsolete trust profile.
• Retries remain bounded and preserve the original TLS policy.
• No unapproved direct fallback occurs.
• Logs expose no credentials, private keys, or raw proxy URLs.
• Old processes and connection pools are drained after deployment.
• Pin rotation has an overlap and rollback plan.

FAQ

Is pinning a replacement for CA and hostname verification?

No. Use pinning as an additional control. Standard peer and hostname validation should remain enabled.

Are all TLS backends affected?

The advisory scopes this issue to OpenSSL and compatible forks. Confirm the backend in the deployed binary rather than assuming it from the operating system.

Does the issue apply to every proxy request?

No. It requires a specific combination of disabled standard verification, configured pinning, an affected backend and version, and a connection without a presented certificate.

What is the preferred fix?

Upgrade curl and libcurl to 8.22.0 or use an official vendor package containing the fix, then validate the effective TLS configuration.

Source note and compliance

Source: curl project, “OpenSSL pinning bypass,” CVE-2026-80230, published September 2, 2026. The external source address is stored only in the internal operations record.

Use proxies only for systems and data you are authorized to access. Respect contracts, privacy obligations, access controls, rate limits, and applicable law. Certificate testing must use controlled infrastructure and must not be used to intercept or bypass third-party protections.