A vulnerability in the libcurl library allows attackers to bypass public key pinning checks, creating a significant security risk for applications that rely on this feature for transport layer integrity.

The flaw, categorized as CWE-295 (Improper Certificate Validation), occurs when CURLOPT_PINNEDPUBLICKEY is used in conjunction with disabled peer verification settings. This allows unauthenticated remote attackers to establish connections that should have been rejected by the pinning mechanism.

Successful exploitation allows an attacker to intercept or manipulate traffic by bypassing certificate pinning, which is intended to prevent man-in-the-middle attacks. While the CVSS score of 7.5 indicates a High severity, the impact is focused on connection integrity rather than direct system compromise. Failure to address this flaw could lead to unauthorized data interception or service disruption in environments relying on strict SSL/TLS validation.

Immediate Action: Review all applications using the libcurl library and ensure that peer verification is enabled whenever possible. Monitor vendor advisories for the release of a patched version of curl and apply updates immediately upon availability.

Proactive Monitoring: Review application logs for unusual connection patterns or frequent handshake failures that may indicate attempts to exploit certificate validation logic.

Compensating Controls: Implement strict network-level egress filtering and use established certificate authorities rather than relying solely on pinned public keys in configurations where verification is disabled.

Public Exploit Available: Unknown.

Security teams must prioritize auditing their codebase for the specific combination of CURLOPT_PINNEDPUBLICKEY and disabled verification flags. Given the existence of a proof-of-concept, it is imperative to move away from configurations that disable peer verification and monitor for official updates from the curl project to resolve the underlying library defect.