{"id":"CURL-CVE-2026-87866","summary":"wolfSSL public-key pinning bypass","details":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey.","aliases":["CVE-2026-87866"],"modified":"2026-10-14T19:03:00.131033665Z","published":"2026-10-14T08:00:00Z","database_specific":{"package":"curl","affects":"both","URL":"https://curl.se/docs/CVE-2026-87866.json","www":"https://curl.se/docs/CVE-2026-87866.html","issue":"https://hackerone.com/reports/3989514","CWE":{"id":"CWE-295","desc":"Improper Certificate Validation"},"last_affected":"8.22.0","severity":"Low"},"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"7.43.0"},{"fixed":"8.14.3"},{"introduced":"8.15.0"},{"fixed":"8.16.2"},{"introduced":"8.17.0"},{"fixed":"8.20.2"},{"introduced":"8.21.0"},{"fixed":"8.23.0"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"0675abbc7572ff6d711a1f325d9b812f98bce78f"},{"fixed":"ed131747c1a3dc7f816d26724c44537ac8acba44"}]}],"versions":["8.22.0","8.21.0","8.20.0","8.19.0","8.18.0","8.17.0","8.16.0","8.15.0","8.14.1","8.14.0","8.13.0","8.12.1","8.12.0","8.11.1","8.11.0","8.10.1","8.10.0","8.9.1","8.9.0","8.8.0","8.7.1","8.7.0","8.6.0","8.5.0","8.4.0","8.3.0","8.2.1","8.2.0","8.1.2","8.1.1","8.1.0","8.0.1","8.0.0","7.88.1","7.88.0","7.87.0","7.86.0","7.85.0","7.84.0","7.83.1","7.83.0","7.82.0","7.81.0","7.80.0","7.79.1","7.79.0","7.78.0","7.77.0","7.76.1","7.76.0","7.75.0","7.74.0","7.73.0","7.72.0","7.71.1","7.71.0","7.70.0","7.69.1","7.69.0","7.68.0","7.67.0","7.66.0","7.65.3","7.65.2","7.65.1","7.65.0","7.64.1","7.64.0","7.63.0","7.62.0","7.61.1","7.61.0","7.60.0","7.59.0","7.58.0","7.57.0","7.56.1","7.56.0","7.55.1","7.55.0","7.54.1","7.54.0","7.53.1","7.53.0","7.52.1","7.52.0","7.51.0","7.50.3","7.50.2","7.50.1","7.50.0","7.49.1","7.49.0","7.48.0","7.47.1","7.47.0","7.46.0","7.45.0","7.44.0","7.43.0","curl-8_22_0","rc-8_22_0-3","rc-8_22_0-2","rc-8_22_0-1","curl-8_21_0","rc-8_21_0-3","rc-8_21_0-2","rc-8_21_0-1","curl-8_20_0","rc-8_20_0-3","rc-8_20_0-2","rc-8_20_0-1","curl-8_19_0","rc-8_19_0-3","rc-8_19_0-2","rc-8_19_0-1","curl-8_18_0","rc-8_18_0-3","rc-8_18_0-2","rc-8_18_0-1","curl-8_17_0","curl-8_16_0","curl-8_15_0","curl-8_14_1","curl-8_14_0","curl-8_13_0","curl-8_12_1","curl-8_12_0","curl-8_11_1","curl-8_11_0","curl-8_10_1","curl-8_10_0","curl-8_9_1","curl-8_9_0","curl-8_8_0","curl-8_7_1","curl-8_7_0","curl-8_6_0","curl-8_5_0","tiny-curl-8_4_0","curl-8_4_0","curl-8_3_0","curl-8_2_1","curl-8_2_0","curl-8_1_2","curl-8_1_1","curl-8_1_0","curl-8_0_1","curl-8_0_0","curl-7_88_1","curl-7_88_0","curl-7_87_0","curl-7_86_0","curl-7_85_0","curl-7_84_0","curl-7_83_1","curl-7_83_0","curl-7_82_0","curl-7_81_0","curl-7_80_0","curl-7_79_1","curl-7_79_0","curl-7_78_0","curl-7_77_0","curl-7_76_1","curl-7_76_0","curl-7_75_0","curl-7_74_0","curl-7_73_0","tiny-curl-7_72_0","curl-7_72_0","curl-7_71_1","curl-7_71_0","curl-7_70_0","curl-7_69_1","curl-7_69_0","curl-7_68_0","curl-7_67_0","curl-7_66_0","curl-7_65_3","curl-7_65_2","curl-7_65_1","curl-7_65_0","curl-7_64_1","curl-7_64_0","curl-7_63_0","curl-7_62_0","curl-7_61_1","curl-7_61_0","curl-7_60_0","curl-7_59_0","curl-7_58_0","curl-7_57_0","curl-7_56_1","curl-7_56_0","curl-7_55_1","curl-7_55_0","curl-7_54_1","curl-7_54_0","curl-7_53_1","curl-7_53_0","curl-7_52_1","curl-7_52_0","curl-7_51_0","curl-7_50_3","curl-7_50_2","curl-7_50_1","curl-7_50_0","curl-7_49_1","curl-7_49_0","curl-7_48_0","curl-7_47_1","curl-7_47_0","curl-7_46_0","curl-7_45_0","curl-7_44_0","curl-7_43_0"],"database_specific":{"vanir_signatures":[{"digest":{"function_hash":"114437314617985002395062913786065412514","length":582},"id":"CURL-CVE-2026-87866-00de029f","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"lib/vtls/x509asn1.c","function":"int2str"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"tests/unit/unit1676.c"},"deprecated":false,"digest":{"line_hashes":["203068376129092837683719079150707671145","41452084002556197996995936638055601683","334130063318760629062515802243366724472","278064826176169222025947887644464230534","194805897393452654822283097578768818696","273133712857428822624195261594514958451","214472085280356560836745067687792990895","284713086547433823746591183342830437234","188733452642720268537722110757238311072"],"threshold":0.9},"id":"CURL-CVE-2026-87866-018f52e4","signature_type":"Line"},{"digest":{"length":1128,"function_hash":"69356269135975011330728746758381737240"},"id":"CURL-CVE-2026-87866-0886a990","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"lib/vtls/x509asn1.c","function":"encodeOID"},"deprecated":false},{"target":{"file":"tests/unit/unit1657.c"},"deprecated":false,"digest":{"line_hashes":["194782447913328223227090657040217593847","223612725948114541323751093366716137691","260999497455442312899031769256604059285","213744608731915570031844004446849518210","185669708432213296266985886452911113632","229579132532754100795299618953104438968","174127523685479893864128966447876084252","192318282883220294245072852781242773505","293782620842921113286815297616039851824","280704630355707457775034067812158909041","65642163363079529322941786599683219280","119814012880875857671720248326213931731","284290808011953687713489196713780577454","197681778623437385975989450921732798015","144227722974548414812885365577616524379","328460135298239357881296319088764733102","227809736693964183286621409603364595923","36639494191986965025704029334749669078","260512318402613303987124203837066004167","123093450715110140265784386646751828644","224959226848781523903265658145293002520","81245488798839740925552630946629137089","117069771036989806718335571924544952776"],"threshold":0.9},"id":"CURL-CVE-2026-87866-0b83f7d7","signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44"},{"deprecated":false,"digest":{"function_hash":"195633627372001842575351133887622510446","length":1442},"id":"CURL-CVE-2026-87866-0f279dd3","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"lib/vtls/x509asn1.c","function":"encodeDN"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"lib/vtls/wolfssl.c","function":"Curl_wssl_verify_pinned"},"deprecated":false,"digest":{"length":1488,"function_hash":"230005123800690746659921455942945758579"},"id":"CURL-CVE-2026-87866-2c3369b0"},{"source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"function":"utf8asn1str","file":"lib/vtls/x509asn1.c"},"deprecated":false,"digest":{"function_hash":"233279999204306806109635529627474743643","length":1616},"id":"CURL-CVE-2026-87866-2c53d86f","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"function":"mbed_extract_certinfo","file":"lib/vtls/mbedtls.c"},"deprecated":false,"digest":{"function_hash":"72097021255652542376899408904048342971","length":636},"id":"CURL-CVE-2026-87866-31f1492f","signature_type":"Function"},{"target":{"function":"test_unit1666","file":"tests/unit/unit1666.c"},"deprecated":false,"digest":{"function_hash":"163860031216669605089464803616823086938","length":5871},"id":"CURL-CVE-2026-87866-37694ae4","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44"},{"signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"lib/vtls/gtls.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["115885153390042330271646242272113879685","54005072936450961668090544154494653208","263768643482283681677157701328267765379","175514619153862397403894831515362611762","220674063475974222388608490344172679697"]},"id":"CURL-CVE-2026-87866-4a9f3aed","signature_type":"Line"},{"source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"lib/vtls/x509asn1.c","function":"octet2str"},"deprecated":false,"digest":{"length":225,"function_hash":"72765254199729778230753521192580051876"},"id":"CURL-CVE-2026-87866-51023db6","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"lib/vtls/x509asn1.h"},"deprecated":false,"digest":{"line_hashes":["316918380292370014459602983004466594460","188697500534120465658370856020444240714","256696735472030935944386774472526959797","88132914913697522359000575938581758348","43316358952486757529139116827338379292","159605773017961721251725106579038003234","30505162172203445493877098438526911907","114736403620325555540291487992677259720","262534359034124619911554156207705553963","54265446128143300954029526841739533935","173074426389041014993612518309602980203","99931091634628020280269485976489909286","95126134743640794896963096731829227697","220602042647754871420596280185884211012","199604709989445783989408337600615317075","144162346264140113678338570040501205524"],"threshold":0.9},"id":"CURL-CVE-2026-87866-57997723","signature_type":"Line"},{"source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"lib/vtls/x509asn1.c","function":"bit2str"},"deprecated":false,"digest":{"function_hash":"29012616661267164304726893672434848747","length":285},"id":"CURL-CVE-2026-87866-5da63eef","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"lib/vtls/gtls.c","function":"Curl_gtls_verifyserver"},"deprecated":false,"digest":{"function_hash":"319661007184090775948124487721961249359","length":4834},"id":"CURL-CVE-2026-87866-64cfc4b6","signature_type":"Function"},{"digest":{"function_hash":"196064155673978177807311555829124848363","length":1266},"id":"CURL-CVE-2026-87866-69acb162","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"lib/vtls/x509asn1.c","function":"ASN1tostr"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["86458062073766620336163744794644586669","109136661568134847708060112049463550498","260635798038839049924708721929473299804","83149618183913364908272541744394893518","157529745476533023553965032398336437167","73260284365606295321375135155865692309","74069128935192332375941748106717696666","284097950854997039111625593797329096364","133017601860180004363003080797469293427","302749417409865530437878848387365252281","109951850043954983987967656360867522111","338220462144702532584685673357129107159","126999059329656065026126569904837292675","244099131532563053905440224134879729062","87554046888004112922001508471672842705","93563336317255984406493715366183626321","335410822524727402048328369871078255785"],"threshold":0.9},"id":"CURL-CVE-2026-87866-8aa8dcf6","signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"lib/vtls/schannel.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"tests/unit/unit1657.c","function":"make1657_nested"},"deprecated":false,"digest":{"function_hash":"58440644970801216644466370873492764095","length":437},"id":"CURL-CVE-2026-87866-97d9616d"},{"deprecated":false,"digest":{"length":3920,"function_hash":"147027864829309578370282163113744792029"},"id":"CURL-CVE-2026-87866-98de3a24","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"lib/vtls/rustls.c","function":"cr_connect"}},{"signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"lib/vtls/schannel.c","function":"add_cert_to_certinfo"},"deprecated":false,"digest":{"function_hash":"250872414491425329564084450462681786050","length":471},"id":"CURL-CVE-2026-87866-9c730fe8","signature_type":"Function"},{"source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"lib/vtls/x509asn1.c"},"deprecated":false,"digest":{"line_hashes":["219929026997453723005493982449339674698","186490773168858305256272319545598244855","229989849706552796488849597977573347324","25358538207790048254111340762929110802","7844224965071187297650106251994562556","111160141840336285762567996566396223754","52653605910942088873351789227255391943","126489865690554385494997844215020213260","173698870565575078960393984728605272196","167999236419023724866861997528683321392","240413170819638764618674334270116743725","178727643215896456436187602188049940514","56396689603077605485386765356250881364","265938235529950418053088321653961866972","289159882856075651928898395085211316963","202808878347514639335344526700521496483","275157602253612039441374500709850798715","230210946609865380234141638092072415400","182988061248169097412580181997125408908","318223698997576722085385167512946400226","299944488027014941698561447894616031480","177783416758210346459718863782427339115","120772104219879936756798113032807796588","293206087052451596761153113035503659265","89853603351182486120832584433052261860","336566081046778670453237422642643066746","225190526702698185311679285603801624092","292996989654007406636890877096771903558","217596749678672078892164739091497691037","99707675887353681994937016379890684172","337158719688582786744042684249512586133","278484484104253202130498408763413798187","238766386674572827148518482275068392121","336881677748113068577220989448101826134","218285028377319823864330263617688561884","2454107537971718773699243114260070284","157486832692137607350362573417887328825","307872782586111612117389923704340942281","193430947648337500000333625173815420181","227969308854739361543691602684768072193","237597039714943797073134877405257529067","205586518532692860839823508072390306502","145164727259452111696400311423889184640","115085069272456527604368049622978281737","39119951846458867202936572832467339121","195490511272728761586348626694005738819","18861420356261146007777626878128765897","288672825582783376291975519920765259238","319878529001268922171439718771970684925","232323749810071073496036503550949553649","13022603830371808725089297098110890058","336776213372590158818435123595675826288","274898383871427406551960731398084891641","121235545475065285461834905943538548837","129808836988074082105426568344032353280","289864536737738555116658660469022903078","297100491129495375239963411026459549253","294101625417784349565148175523334134636","173538248520447067805984131169927026548","235471344519258376275147718826069817386","31320060021891701714048932688355160564","87676838631502473501829921799279917362","153925780268343496857460380834642910114","84302243926346370108395412291366533678","155040838535488287894483411052742503796","192460135040959005668818490438799750204","182146330396263438016501941903394004204","125002698354852356990251615883233663792","197091980265234551379524037963136606","306196961792551517521400884457498221867","124490309356704235116512817664794053061","207288040369356833578553049594660256686","191114121331544975532870369454985425668","19838478787475086257615657865812153731","165353960636361187903996019113205400484","55369768426473498996028264211714287530","84831874941434567859070723109642670199","169358742126525164586356930799693116796","287205752159603142386554621173190203839","135671699694451256404219975320176118251","105100961753804137635270842001023405633","17043967482080809844287213590386840433","244240222112305837346368162508278393435","131270525779052087306665498281317574569","64172654481787935762472344729186957771","205005244928089439043886776404486507417","8556921114150790975002212788404955010","272348316757325282600508151519987287215","302049992949821068506866007036058424921","162963737745438796534714530756564222259","310871174206477631443633623732000447694","239584181162362822368970131497969761625","86649685914105626638109900917383162527","188990966615196285373220460899868968949","323421914823273372396031590727162638879","314051406237091440010478140888359828348","85974973258075267736770442628716794539","58024996615701620293762970551039726087","60615835718313379789193989613440076371","171244342528777646471966138367815568476","61340352001437251352782284776550854114","256437390824481181787691316654735993371","61671738244008595304195696082357134470","45161557707028747324609269355572361758","12363931795821603781097866421986361458","204008457621248612577104575045099700777","215386311371608188668892054388572113403","36789671704521532154994005315634791903","269103734743397746102222744577670710268","337099991159097990285867858707748574595","196099221585764131967575031848412956506","170708817799337763331835926541715959913","226801683581150648859136776468736379852","126967926762499578344136612826375064982","233377665868400279360978454767994027234","180155858811367820219038545065641017163","216803777391639318543760369153704006362","318540158970592865800190881593175073708","306676372152199634763573629391302748374","168380989336687456954466512915032891","170082682194891174490860506339507061953","49534622787149327880034199954685837461","317477209025593526633732588453869111969","61882913238005591326005314069692226410","257887416711040465699553757197997267105","324460437097912384147229314045797812822","21920572028771545225216039935873739101","316880347569033717797398422516292326936","240263760250220936262217308755441020353","113385906906170241582792388126945054364","54775142476022990887994696595815636355","26198821529640504772248781853103245690","335527041933392638377601870317082392158","249884871739601014598702810086688062424","256767146979672322862369018010536794902","274839469930458904697389180622426754509","228028255712062017110352019726480910064","160507024959362874347251080748438112436","326487279552123085244327539856386160001","269348877880917417758381728902914489219","201922960653132664709971418668334572978","174721448449352083523751702401937874339","279805728155781252039959225973815682081","167195878464536208105181959992453621000","9774874670918506765192827985300518173","334711432930710226106741762680575108531","132557563770723550693925825198410881392","36322295291323404199181958583718573979","122493432519996948561421585852571053277","194143530245224843265719262539781789861","72150504550865211852299993662061402264","47176823551256333488773701209145703758","127650948444884254504945263198399281638","294535608423685003824067298674296782590","168683778861574454159606421631548165819","7189178590168054630546950330280898490","129772678813790248040076554659365285654","85116380147248475012171627012332805516","46238901565224443504624916041383745562","191203037470429441563239553791425893439","104372587678880835227986967720990257029","201120737098869874247247042245150276936","219626142255874290634277935912898528316","20312969478666567364860546942298178311","133068199369272389255109218348499907087","338598233039753073948090581015360752920","212802546008124087090308114696388131231","234917179633580702846617812202200061324","149305917355247475802170692658590060840","160904127436846221716943164213423774424","263986803801147172596500721626515258708","81225277116924060121362386853370243653","315289552560490128965616305653457864325","282310730325130278673101960254064602509","326386064413226935914388431805091266485","170538255164775897461548368234884416414","282102631916899883072631944511387884551"],"threshold":0.9},"id":"CURL-CVE-2026-87866-9d41fbc8","signature_type":"Line","signature_version":"v1"},{"id":"CURL-CVE-2026-87866-b10f796e","signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"lib/vtls/rustls.c"},"deprecated":false,"digest":{"line_hashes":["97466414257407883395292888574868241893","111700234877134748667993527602658971037","227661980739769534715075656462698418157","165716842201907864830404455676517773628","222381152888428111079306531096565250523","28177791059573786382487458683347388272","178755148865428635594325794672840311594","114315600304320577264722741841842875380","244186092985304136634782660592231181447","216831755069503956063757883869510327447","21810293867258140431355848813934272771","201593001172380692062489055214568746391"],"threshold":0.9}},{"digest":{"function_hash":"336191080090944069017557397100713255231","length":2826},"id":"CURL-CVE-2026-87866-bb001dcf","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"tests/unit/unit1676.c","function":"test_unit1676"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["305587252130698316460094315381774184906","99050099184925550389068003624476260010","244203629523787624834046032498624797669","21711592029749670831376912763923156578"],"threshold":0.9},"id":"CURL-CVE-2026-87866-c0aecf86","signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"tests/unit/unit1667.c"}},{"target":{"file":"lib/vtls/x509asn1.c","function":"bool2str"},"deprecated":false,"digest":{"length":320,"function_hash":"262567729765833135779803934026439219884"},"id":"CURL-CVE-2026-87866-c8944685","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44"},{"deprecated":false,"digest":{"function_hash":"207595777064648554663723477627657500111","length":3538},"id":"CURL-CVE-2026-87866-ce6e6fff","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"lib/vtls/x509asn1.c","function":"Curl_extract_certinfo"}},{"digest":{"length":2511,"function_hash":"99678393561943486019189239483635475641"},"id":"CURL-CVE-2026-87866-d0fa2da2","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"lib/vtls/x509asn1.c","function":"do_pubkey"},"deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["306605987024302590250828273943916695978","294560520481176611640951463452180009404","82023115464328077544218217347849206759","179882134985965219392098358543652642168","140601249321335649807626608206330493485","273133712857428822624195261594514958451","214472085280356560836745067687792990895","209322153820291789771669096320520077728","49898329882714114836016056797637811079"]},"id":"CURL-CVE-2026-87866-d5750fe2","signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"tests/unit/unit1651.c"},"deprecated":false},{"source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"tests/unit/unit1666.c"},"deprecated":false,"digest":{"line_hashes":["133007184222243641208168165494651640287","128260166847870336466255951283625933041","84299423391821765285663547807212099680","128919590920811611533241202008374661748","230940766786770462951859312083284186576","150541303602362539627894913577691777192","56886430722965952235231803163950411019","65488608355392391996086555082395151831","190106261772493660669364187676923728773","115702133150338733529349365276176507907","223771623791514454531640518343461872148","57954979082588265424068437884339123491","332580695658266678442310157884619450494","13373338759758431962279241186024561375","261571262589917082342950079936809588437","319388641557638102594116632607533782116","147672765642013755178820998554172745332","20224858547080884498276042935084160375"],"threshold":0.9},"id":"CURL-CVE-2026-87866-da7d9b43","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"length":1302,"function_hash":"221584606528355640615294665754000581724"},"id":"CURL-CVE-2026-87866-def8b060","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"function":"getASN1Element_","file":"lib/vtls/x509asn1.c"}},{"target":{"file":"lib/vtls/wolfssl.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["7671862156806293262341547085436474992","114150561080538110789722768383779603814","82349626409770870076332888080477082321","14478133730995750545345035990820203139","185409460600124701743790010255350636425","284910572847715814651764637518741673337","203314959096297963805611583220307312970","163261911585087101422423170081853080674"]},"id":"CURL-CVE-2026-87866-e0712591","signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44"},{"source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"function":"Curl_parseX509","file":"lib/vtls/x509asn1.c"},"deprecated":false,"digest":{"function_hash":"110461886969499039255384011430801808950","length":2890},"id":"CURL-CVE-2026-87866-ebef1acc","signature_type":"Function","signature_version":"v1"},{"target":{"file":"lib/vtls/mbedtls.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["305305977373363663883159116438234165601","307690880374601809619433528522804651707","111412074371603513395963016935996141499","197383010496327723846176578679035214245","220539912038637188438313025556709561937","97134169239829074267142822890609021299"]},"id":"CURL-CVE-2026-87866-f120bb48","signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44"},{"source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"tests/unit/unit1667.c","function":"test1667"},"deprecated":false,"digest":{"function_hash":"128978374623801708679933724585097538573","length":1410},"id":"CURL-CVE-2026-87866-f35a95e6","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"function":"schannel_pkp_pin_peer_pubkey","file":"lib/vtls/schannel.c"},"deprecated":false,"digest":{"length":1400,"function_hash":"105371343149438558469253413400522070783"},"id":"CURL-CVE-2026-87866-f63dc668"},{"signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"tests/unit/unit1657.c","function":"test_unit1657"},"deprecated":false,"digest":{"function_hash":"251329385112454927636629628215225004879","length":515},"id":"CURL-CVE-2026-87866-fde1c40b","signature_type":"Function"},{"source":"https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44","target":{"file":"tests/unit/unit1651.c","function":"test_unit1651"},"deprecated":false,"digest":{"length":28527,"function_hash":"242916654709061833496981989695182126575"},"id":"CURL-CVE-2026-87866-fec24af0","signature_type":"Function","signature_version":"v1"}],"vanir_signatures_modified":"2026-10-14T19:03:00Z","source":"https://curl.se/docs/CURL-CVE-2026-87866.json"}}],"schema_version":"1.9.0","credits":[{"name":"Muhamad Arga Reksapati","type":"FINDER"},{"name":"Stefan Eissing","type":"REMEDIATION_DEVELOPER"}]}