When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.

When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.

curl-8.23.0-1.1 on GA media

curl: libcurl: Curl out of bounds read for cookie path curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers curl: libcurl: Improper certificate validation due to cached TLS settings reuse curl: curl: stale SigV4 headers sent unintended curl: curl: redirect to SFTP or SCP bypasses host verification curl: curl: FTP connection reuse inherits client-certificate curl: curl: server-set cookie erases cookie jar curl: curl: Negotiate credentials sent to redirected origin curl: curl: leaking host credentials to HTTP proxy curl: curl: cross-origin reuse of a Negotiate connection curl: curl: HSTS cache import drops longer-lived child curl: curl: Hsts Response Erases Persisted Entries curl: IMAP APPEND plus CRLF conversion command injection curl: curl: knownhost callback mismatches key as missing curl: curl: wolfSSL public-key pinning bypass curl: curl: server-set cookie aborts cookie jar load curl: curl: never-ending loop via server response omission curl: curl: FTP wildcard write callback mixup curl: curl: TFTP direction confusion curl: curl: -J no-clobber guarantee bypassed with 103 early hints curl: curl: curl_mime_free stack overflow by recursion curl: curl: HTTP/2 upload Use-After-Free curl: curl: Authorization: Negotiate sent to foreign origin curl: curl: password leak in CURLINFO_EFFECTIVE_URL curl: curl: info leak uploading over WebSockets with GnuTLS curl: curl: local interface connection reuse mixup