CURL-CVE-2026-87866

See a problem?
Please try reporting it to the source first.
Source
https://curl.se/docs/CVE-2026-87866.html
Import Source
https://curl.se/docs/CURL-CVE-2026-87866.json
JSON Data
https://api.osv.dev/v1/vulns/CURL-CVE-2026-87866
Aliases
  • CVE-2026-87866
Published
2026-10-14T08:00:00Z
Modified
2026-10-14T19:03:00Z
Summary
wolfSSL public-key pinning bypass
Details

When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.

Database specific 
{
    "CWE":  {
        "desc":  "Improper Certificate Validation",
        "id":  "CWE-295"
    },
    "URL":  "https://curl.se/docs/CVE-2026-87866.json",
    "affects":  "both",
    "issue":  "https://hackerone.com/reports/3989514",
    "last_affected":  "8.22.0",
    "package":  "curl",
    "severity":  "Low",
    "www":  "https://curl.se/docs/CVE-2026-87866.html"
}
Credits
    • Muhamad Arga Reksapati - FINDER
    • Stefan Eissing - REMEDIATION_DEVELOPER

Affected packages

Git / github.com/curl/curl.git

Affected ranges

Type
SEMVER
Events
Introduced
7.43.0
Fixed
8.14.3
Introduced
8.15.0
Fixed
8.16.2
Introduced
8.17.0
Fixed
8.20.2
Introduced
8.21.0
Fixed
8.23.0
Type
GIT
Repo
https://github.com/curl/curl.git
Events
Introduced
0675abbc7572ff6d711a1f325d9b812f98bce78f
Fixed
ed131747c1a3dc7f816d26724c44537ac8acba44

Affected versions

7.*
7.43.0
7.44.0
7.45.0
7.46.0
7.47.0
7.47.1
7.48.0
7.49.0
7.49.1
7.50.0
7.50.1
7.50.2
7.50.3
7.51.0
7.52.0
7.52.1
7.53.0
7.53.1
7.54.0
7.54.1
7.55.0
7.55.1
7.56.0
7.56.1
7.57.0
7.58.0
7.59.0
7.60.0
7.61.0
7.61.1
7.62.0
7.63.0
7.64.0
7.64.1
7.65.0
7.65.1
7.65.2
7.65.3
7.66.0
7.67.0
7.68.0
7.69.0
7.69.1
7.70.0
7.71.0
7.71.1
7.72.0
7.73.0
7.74.0
7.75.0
7.76.0
7.76.1
7.77.0
7.78.0
7.79.0
7.79.1
7.80.0
7.81.0
7.82.0
7.83.0
7.83.1
7.84.0
7.85.0
7.86.0
7.87.0
7.88.0
7.88.1
8.*
8.0.0
8.0.1
8.1.0
8.1.1
8.1.2
8.10.0
8.10.1
8.11.0
8.11.1
8.12.0
8.12.1
8.13.0
8.14.0
8.14.1
8.15.0
8.16.0
8.17.0
8.18.0
8.19.0
8.2.0
8.2.1
8.20.0
8.21.0
8.22.0
8.3.0
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
Other
curl-7_43_0
curl-7_44_0
curl-7_45_0
curl-7_46_0
curl-7_47_0
curl-7_47_1
curl-7_48_0
curl-7_49_0
curl-7_49_1
curl-7_50_0
curl-7_50_1
curl-7_50_2
curl-7_50_3
curl-7_51_0
curl-7_52_0
curl-7_52_1
curl-7_53_0
curl-7_53_1
curl-7_54_0
curl-7_54_1
curl-7_55_0
curl-7_55_1
curl-7_56_0
curl-7_56_1
curl-7_57_0
curl-7_58_0
curl-7_59_0
curl-7_60_0
curl-7_61_0
curl-7_61_1
curl-7_62_0
curl-7_63_0
curl-7_64_0
curl-7_64_1
curl-7_65_0
curl-7_65_1
curl-7_65_2
curl-7_65_3
curl-7_66_0
curl-7_67_0
curl-7_68_0
curl-7_69_0
curl-7_69_1
curl-7_70_0
curl-7_71_0
curl-7_71_1
curl-7_72_0
curl-7_73_0
curl-7_74_0
curl-7_75_0
curl-7_76_0
curl-7_76_1
curl-7_77_0
curl-7_78_0
curl-7_79_0
curl-7_79_1
curl-7_80_0
curl-7_81_0
curl-7_82_0
curl-7_83_0
curl-7_83_1
curl-7_84_0
curl-7_85_0
curl-7_86_0
curl-7_87_0
curl-7_88_0
curl-7_88_1
curl-8_0_0
curl-8_0_1
curl-8_10_0
curl-8_10_1
curl-8_11_0
curl-8_11_1
curl-8_12_0
curl-8_12_1
curl-8_13_0
curl-8_14_0
curl-8_14_1
curl-8_15_0
curl-8_16_0
curl-8_17_0
curl-8_18_0
curl-8_19_0
curl-8_1_0
curl-8_1_1
curl-8_1_2
curl-8_20_0
curl-8_21_0
curl-8_22_0
curl-8_2_0
curl-8_2_1
curl-8_3_0
curl-8_4_0
curl-8_5_0
curl-8_6_0
curl-8_7_0
curl-8_7_1
curl-8_8_0
curl-8_9_0
curl-8_9_1
rc-8_18_0-1
rc-8_18_0-2
rc-8_18_0-3
rc-8_19_0-1
rc-8_19_0-2
rc-8_19_0-3
rc-8_20_0-1
rc-8_20_0-2
rc-8_20_0-3
rc-8_21_0-1
rc-8_21_0-2
rc-8_21_0-3
rc-8_22_0-1
rc-8_22_0-2
rc-8_22_0-3
tiny-curl-7_72_0
tiny-curl-8_4_0

Database specific

source 
"https://curl.se/docs/CURL-CVE-2026-87866.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "114437314617985002395062913786065412514",
            "length":  582
        },
        "id":  "CURL-CVE-2026-87866-00de029f",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "lib/vtls/x509asn1.c",
            "function":  "int2str"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "203068376129092837683719079150707671145",
                "41452084002556197996995936638055601683",
                "334130063318760629062515802243366724472",
                "278064826176169222025947887644464230534",
                "194805897393452654822283097578768818696",
                "273133712857428822624195261594514958451",
                "214472085280356560836745067687792990895",
                "284713086547433823746591183342830437234",
                "188733452642720268537722110757238311072"
            ],
            "threshold":  0.9
        },
        "id":  "CURL-CVE-2026-87866-018f52e4",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "tests/unit/unit1676.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "69356269135975011330728746758381737240",
            "length":  1128
        },
        "id":  "CURL-CVE-2026-87866-0886a990",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "lib/vtls/x509asn1.c",
            "function":  "encodeOID"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "194782447913328223227090657040217593847",
                "223612725948114541323751093366716137691",
                "260999497455442312899031769256604059285",
                "213744608731915570031844004446849518210",
                "185669708432213296266985886452911113632",
                "229579132532754100795299618953104438968",
                "174127523685479893864128966447876084252",
                "192318282883220294245072852781242773505",
                "293782620842921113286815297616039851824",
                "280704630355707457775034067812158909041",
                "65642163363079529322941786599683219280",
                "119814012880875857671720248326213931731",
                "284290808011953687713489196713780577454",
                "197681778623437385975989450921732798015",
                "144227722974548414812885365577616524379",
                "328460135298239357881296319088764733102",
                "227809736693964183286621409603364595923",
                "36639494191986965025704029334749669078",
                "260512318402613303987124203837066004167",
                "123093450715110140265784386646751828644",
                "224959226848781523903265658145293002520",
                "81245488798839740925552630946629137089",
                "117069771036989806718335571924544952776"
            ],
            "threshold":  0.9
        },
        "id":  "CURL-CVE-2026-87866-0b83f7d7",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "tests/unit/unit1657.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "195633627372001842575351133887622510446",
            "length":  1442
        },
        "id":  "CURL-CVE-2026-87866-0f279dd3",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "lib/vtls/x509asn1.c",
            "function":  "encodeDN"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "230005123800690746659921455942945758579",
            "length":  1488
        },
        "id":  "CURL-CVE-2026-87866-2c3369b0",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "lib/vtls/wolfssl.c",
            "function":  "Curl_wssl_verify_pinned"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "233279999204306806109635529627474743643",
            "length":  1616
        },
        "id":  "CURL-CVE-2026-87866-2c53d86f",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "lib/vtls/x509asn1.c",
            "function":  "utf8asn1str"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "72097021255652542376899408904048342971",
            "length":  636
        },
        "id":  "CURL-CVE-2026-87866-31f1492f",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "lib/vtls/mbedtls.c",
            "function":  "mbed_extract_certinfo"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "163860031216669605089464803616823086938",
            "length":  5871
        },
        "id":  "CURL-CVE-2026-87866-37694ae4",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "tests/unit/unit1666.c",
            "function":  "test_unit1666"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "115885153390042330271646242272113879685",
                "54005072936450961668090544154494653208",
                "263768643482283681677157701328267765379",
                "175514619153862397403894831515362611762",
                "220674063475974222388608490344172679697"
            ],
            "threshold":  0.9
        },
        "id":  "CURL-CVE-2026-87866-4a9f3aed",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "lib/vtls/gtls.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "72765254199729778230753521192580051876",
            "length":  225
        },
        "id":  "CURL-CVE-2026-87866-51023db6",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "lib/vtls/x509asn1.c",
            "function":  "octet2str"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "316918380292370014459602983004466594460",
                "188697500534120465658370856020444240714",
                "256696735472030935944386774472526959797",
                "88132914913697522359000575938581758348",
                "43316358952486757529139116827338379292",
                "159605773017961721251725106579038003234",
                "30505162172203445493877098438526911907",
                "114736403620325555540291487992677259720",
                "262534359034124619911554156207705553963",
                "54265446128143300954029526841739533935",
                "173074426389041014993612518309602980203",
                "99931091634628020280269485976489909286",
                "95126134743640794896963096731829227697",
                "220602042647754871420596280185884211012",
                "199604709989445783989408337600615317075",
                "144162346264140113678338570040501205524"
            ],
            "threshold":  0.9
        },
        "id":  "CURL-CVE-2026-87866-57997723",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "lib/vtls/x509asn1.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "29012616661267164304726893672434848747",
            "length":  285
        },
        "id":  "CURL-CVE-2026-87866-5da63eef",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "lib/vtls/x509asn1.c",
            "function":  "bit2str"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "319661007184090775948124487721961249359",
            "length":  4834
        },
        "id":  "CURL-CVE-2026-87866-64cfc4b6",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "lib/vtls/gtls.c",
            "function":  "Curl_gtls_verifyserver"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "196064155673978177807311555829124848363",
            "length":  1266
        },
        "id":  "CURL-CVE-2026-87866-69acb162",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "lib/vtls/x509asn1.c",
            "function":  "ASN1tostr"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "86458062073766620336163744794644586669",
                "109136661568134847708060112049463550498",
                "260635798038839049924708721929473299804",
                "83149618183913364908272541744394893518",
                "157529745476533023553965032398336437167",
                "73260284365606295321375135155865692309",
                "74069128935192332375941748106717696666",
                "284097950854997039111625593797329096364",
                "133017601860180004363003080797469293427",
                "302749417409865530437878848387365252281",
                "109951850043954983987967656360867522111",
                "338220462144702532584685673357129107159",
                "126999059329656065026126569904837292675",
                "244099131532563053905440224134879729062",
                "87554046888004112922001508471672842705",
                "93563336317255984406493715366183626321",
                "335410822524727402048328369871078255785"
            ],
            "threshold":  0.9
        },
        "id":  "CURL-CVE-2026-87866-8aa8dcf6",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "lib/vtls/schannel.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "58440644970801216644466370873492764095",
            "length":  437
        },
        "id":  "CURL-CVE-2026-87866-97d9616d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "tests/unit/unit1657.c",
            "function":  "make1657_nested"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "147027864829309578370282163113744792029",
            "length":  3920
        },
        "id":  "CURL-CVE-2026-87866-98de3a24",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "lib/vtls/rustls.c",
            "function":  "cr_connect"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "250872414491425329564084450462681786050",
            "length":  471
        },
        "id":  "CURL-CVE-2026-87866-9c730fe8",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "lib/vtls/schannel.c",
            "function":  "add_cert_to_certinfo"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "219929026997453723005493982449339674698",
                "186490773168858305256272319545598244855",
                "229989849706552796488849597977573347324",
                "25358538207790048254111340762929110802",
                "7844224965071187297650106251994562556",
                "111160141840336285762567996566396223754",
                "52653605910942088873351789227255391943",
                "126489865690554385494997844215020213260",
                "173698870565575078960393984728605272196",
                "167999236419023724866861997528683321392",
                "240413170819638764618674334270116743725",
                "178727643215896456436187602188049940514",
                "56396689603077605485386765356250881364",
                "265938235529950418053088321653961866972",
                "289159882856075651928898395085211316963",
                "202808878347514639335344526700521496483",
                "275157602253612039441374500709850798715",
                "230210946609865380234141638092072415400",
                "182988061248169097412580181997125408908",
                "318223698997576722085385167512946400226",
                "299944488027014941698561447894616031480",
                "177783416758210346459718863782427339115",
                "120772104219879936756798113032807796588",
                "293206087052451596761153113035503659265",
                "89853603351182486120832584433052261860",
                "336566081046778670453237422642643066746",
                "225190526702698185311679285603801624092",
                "292996989654007406636890877096771903558",
                "217596749678672078892164739091497691037",
                "99707675887353681994937016379890684172",
                "337158719688582786744042684249512586133",
                "278484484104253202130498408763413798187",
                "238766386674572827148518482275068392121",
                "336881677748113068577220989448101826134",
                "218285028377319823864330263617688561884",
                "2454107537971718773699243114260070284",
                "157486832692137607350362573417887328825",
                "307872782586111612117389923704340942281",
                "193430947648337500000333625173815420181",
                "227969308854739361543691602684768072193",
                "237597039714943797073134877405257529067",
                "205586518532692860839823508072390306502",
                "145164727259452111696400311423889184640",
                "115085069272456527604368049622978281737",
                "39119951846458867202936572832467339121",
                "195490511272728761586348626694005738819",
                "18861420356261146007777626878128765897",
                "288672825582783376291975519920765259238",
                "319878529001268922171439718771970684925",
                "232323749810071073496036503550949553649",
                "13022603830371808725089297098110890058",
                "336776213372590158818435123595675826288",
                "274898383871427406551960731398084891641",
                "121235545475065285461834905943538548837",
                "129808836988074082105426568344032353280",
                "289864536737738555116658660469022903078",
                "297100491129495375239963411026459549253",
                "294101625417784349565148175523334134636",
                "173538248520447067805984131169927026548",
                "235471344519258376275147718826069817386",
                "31320060021891701714048932688355160564",
                "87676838631502473501829921799279917362",
                "153925780268343496857460380834642910114",
                "84302243926346370108395412291366533678",
                "155040838535488287894483411052742503796",
                "192460135040959005668818490438799750204",
                "182146330396263438016501941903394004204",
                "125002698354852356990251615883233663792",
                "197091980265234551379524037963136606",
                "306196961792551517521400884457498221867",
                "124490309356704235116512817664794053061",
                "207288040369356833578553049594660256686",
                "191114121331544975532870369454985425668",
                "19838478787475086257615657865812153731",
                "165353960636361187903996019113205400484",
                "55369768426473498996028264211714287530",
                "84831874941434567859070723109642670199",
                "169358742126525164586356930799693116796",
                "287205752159603142386554621173190203839",
                "135671699694451256404219975320176118251",
                "105100961753804137635270842001023405633",
                "17043967482080809844287213590386840433",
                "244240222112305837346368162508278393435",
                "131270525779052087306665498281317574569",
                "64172654481787935762472344729186957771",
                "205005244928089439043886776404486507417",
                "8556921114150790975002212788404955010",
                "272348316757325282600508151519987287215",
                "302049992949821068506866007036058424921",
                "162963737745438796534714530756564222259",
                "310871174206477631443633623732000447694",
                "239584181162362822368970131497969761625",
                "86649685914105626638109900917383162527",
                "188990966615196285373220460899868968949",
                "323421914823273372396031590727162638879",
                "314051406237091440010478140888359828348",
                "85974973258075267736770442628716794539",
                "58024996615701620293762970551039726087",
                "60615835718313379789193989613440076371",
                "171244342528777646471966138367815568476",
                "61340352001437251352782284776550854114",
                "256437390824481181787691316654735993371",
                "61671738244008595304195696082357134470",
                "45161557707028747324609269355572361758",
                "12363931795821603781097866421986361458",
                "204008457621248612577104575045099700777",
                "215386311371608188668892054388572113403",
                "36789671704521532154994005315634791903",
                "269103734743397746102222744577670710268",
                "337099991159097990285867858707748574595",
                "196099221585764131967575031848412956506",
                "170708817799337763331835926541715959913",
                "226801683581150648859136776468736379852",
                "126967926762499578344136612826375064982",
                "233377665868400279360978454767994027234",
                "180155858811367820219038545065641017163",
                "216803777391639318543760369153704006362",
                "318540158970592865800190881593175073708",
                "306676372152199634763573629391302748374",
                "168380989336687456954466512915032891",
                "170082682194891174490860506339507061953",
                "49534622787149327880034199954685837461",
                "317477209025593526633732588453869111969",
                "61882913238005591326005314069692226410",
                "257887416711040465699553757197997267105",
                "324460437097912384147229314045797812822",
                "21920572028771545225216039935873739101",
                "316880347569033717797398422516292326936",
                "240263760250220936262217308755441020353",
                "113385906906170241582792388126945054364",
                "54775142476022990887994696595815636355",
                "26198821529640504772248781853103245690",
                "335527041933392638377601870317082392158",
                "249884871739601014598702810086688062424",
                "256767146979672322862369018010536794902",
                "274839469930458904697389180622426754509",
                "228028255712062017110352019726480910064",
                "160507024959362874347251080748438112436",
                "326487279552123085244327539856386160001",
                "269348877880917417758381728902914489219",
                "201922960653132664709971418668334572978",
                "174721448449352083523751702401937874339",
                "279805728155781252039959225973815682081",
                "167195878464536208105181959992453621000",
                "9774874670918506765192827985300518173",
                "334711432930710226106741762680575108531",
                "132557563770723550693925825198410881392",
                "36322295291323404199181958583718573979",
                "122493432519996948561421585852571053277",
                "194143530245224843265719262539781789861",
                "72150504550865211852299993662061402264",
                "47176823551256333488773701209145703758",
                "127650948444884254504945263198399281638",
                "294535608423685003824067298674296782590",
                "168683778861574454159606421631548165819",
                "7189178590168054630546950330280898490",
                "129772678813790248040076554659365285654",
                "85116380147248475012171627012332805516",
                "46238901565224443504624916041383745562",
                "191203037470429441563239553791425893439",
                "104372587678880835227986967720990257029",
                "201120737098869874247247042245150276936",
                "219626142255874290634277935912898528316",
                "20312969478666567364860546942298178311",
                "133068199369272389255109218348499907087",
                "338598233039753073948090581015360752920",
                "212802546008124087090308114696388131231",
                "234917179633580702846617812202200061324",
                "149305917355247475802170692658590060840",
                "160904127436846221716943164213423774424",
                "263986803801147172596500721626515258708",
                "81225277116924060121362386853370243653",
                "315289552560490128965616305653457864325",
                "282310730325130278673101960254064602509",
                "326386064413226935914388431805091266485",
                "170538255164775897461548368234884416414",
                "282102631916899883072631944511387884551"
            ],
            "threshold":  0.9
        },
        "id":  "CURL-CVE-2026-87866-9d41fbc8",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "lib/vtls/x509asn1.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "97466414257407883395292888574868241893",
                "111700234877134748667993527602658971037",
                "227661980739769534715075656462698418157",
                "165716842201907864830404455676517773628",
                "222381152888428111079306531096565250523",
                "28177791059573786382487458683347388272",
                "178755148865428635594325794672840311594",
                "114315600304320577264722741841842875380",
                "244186092985304136634782660592231181447",
                "216831755069503956063757883869510327447",
                "21810293867258140431355848813934272771",
                "201593001172380692062489055214568746391"
            ],
            "threshold":  0.9
        },
        "id":  "CURL-CVE-2026-87866-b10f796e",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "lib/vtls/rustls.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "336191080090944069017557397100713255231",
            "length":  2826
        },
        "id":  "CURL-CVE-2026-87866-bb001dcf",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "tests/unit/unit1676.c",
            "function":  "test_unit1676"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "305587252130698316460094315381774184906",
                "99050099184925550389068003624476260010",
                "244203629523787624834046032498624797669",
                "21711592029749670831376912763923156578"
            ],
            "threshold":  0.9
        },
        "id":  "CURL-CVE-2026-87866-c0aecf86",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "tests/unit/unit1667.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "262567729765833135779803934026439219884",
            "length":  320
        },
        "id":  "CURL-CVE-2026-87866-c8944685",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "lib/vtls/x509asn1.c",
            "function":  "bool2str"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "207595777064648554663723477627657500111",
            "length":  3538
        },
        "id":  "CURL-CVE-2026-87866-ce6e6fff",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "lib/vtls/x509asn1.c",
            "function":  "Curl_extract_certinfo"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "99678393561943486019189239483635475641",
            "length":  2511
        },
        "id":  "CURL-CVE-2026-87866-d0fa2da2",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "lib/vtls/x509asn1.c",
            "function":  "do_pubkey"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "306605987024302590250828273943916695978",
                "294560520481176611640951463452180009404",
                "82023115464328077544218217347849206759",
                "179882134985965219392098358543652642168",
                "140601249321335649807626608206330493485",
                "273133712857428822624195261594514958451",
                "214472085280356560836745067687792990895",
                "209322153820291789771669096320520077728",
                "49898329882714114836016056797637811079"
            ],
            "threshold":  0.9
        },
        "id":  "CURL-CVE-2026-87866-d5750fe2",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "tests/unit/unit1651.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "133007184222243641208168165494651640287",
                "128260166847870336466255951283625933041",
                "84299423391821765285663547807212099680",
                "128919590920811611533241202008374661748",
                "230940766786770462951859312083284186576",
                "150541303602362539627894913577691777192",
                "56886430722965952235231803163950411019",
                "65488608355392391996086555082395151831",
                "190106261772493660669364187676923728773",
                "115702133150338733529349365276176507907",
                "223771623791514454531640518343461872148",
                "57954979082588265424068437884339123491",
                "332580695658266678442310157884619450494",
                "13373338759758431962279241186024561375",
                "261571262589917082342950079936809588437",
                "319388641557638102594116632607533782116",
                "147672765642013755178820998554172745332",
                "20224858547080884498276042935084160375"
            ],
            "threshold":  0.9
        },
        "id":  "CURL-CVE-2026-87866-da7d9b43",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "tests/unit/unit1666.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "221584606528355640615294665754000581724",
            "length":  1302
        },
        "id":  "CURL-CVE-2026-87866-def8b060",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "lib/vtls/x509asn1.c",
            "function":  "getASN1Element_"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "7671862156806293262341547085436474992",
                "114150561080538110789722768383779603814",
                "82349626409770870076332888080477082321",
                "14478133730995750545345035990820203139",
                "185409460600124701743790010255350636425",
                "284910572847715814651764637518741673337",
                "203314959096297963805611583220307312970",
                "163261911585087101422423170081853080674"
            ],
            "threshold":  0.9
        },
        "id":  "CURL-CVE-2026-87866-e0712591",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "lib/vtls/wolfssl.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "110461886969499039255384011430801808950",
            "length":  2890
        },
        "id":  "CURL-CVE-2026-87866-ebef1acc",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "lib/vtls/x509asn1.c",
            "function":  "Curl_parseX509"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "305305977373363663883159116438234165601",
                "307690880374601809619433528522804651707",
                "111412074371603513395963016935996141499",
                "197383010496327723846176578679035214245",
                "220539912038637188438313025556709561937",
                "97134169239829074267142822890609021299"
            ],
            "threshold":  0.9
        },
        "id":  "CURL-CVE-2026-87866-f120bb48",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "lib/vtls/mbedtls.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "128978374623801708679933724585097538573",
            "length":  1410
        },
        "id":  "CURL-CVE-2026-87866-f35a95e6",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "tests/unit/unit1667.c",
            "function":  "test1667"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "105371343149438558469253413400522070783",
            "length":  1400
        },
        "id":  "CURL-CVE-2026-87866-f63dc668",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "lib/vtls/schannel.c",
            "function":  "schannel_pkp_pin_peer_pubkey"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "251329385112454927636629628215225004879",
            "length":  515
        },
        "id":  "CURL-CVE-2026-87866-fde1c40b",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "tests/unit/unit1657.c",
            "function":  "test_unit1657"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "242916654709061833496981989695182126575",
            "length":  28527
        },
        "id":  "CURL-CVE-2026-87866-fec24af0",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/ed131747c1a3dc7f816d26724c44537ac8acba44",
        "target":  {
            "file":  "tests/unit/unit1651.c",
            "function":  "test_unit1651"
        }
    }
]
vanir_signatures_modified 
"2026-10-14T19:03:00Z"