This vulnerability arises when curl is built with the wolfSSL backend and allows a remote attacker to bypass public key pinning during the TLS handshake. A specially crafted certificate that contains a manipulated validity length field forces curl to incorrectly re‑parse the certificate, causing the client to accept an invalid key as valid. The consequence is that an attacker can impersonate a legitimate server, enabling man‑in‑the‑middle attacks, credential theft, or data injection. The weakness is classified as CWE‑295, an authentication flaw involving certificate validation.

The affected product is the open‑source curl client when compiled with the wolfSSL backend. No specific version ranges are provided in the advisory, so all builds that include the wolfSSL backend and have the certificate parsing bug are potentially vulnerable. The vulnerability applies to any system that connects to a malicious server using this configuration.

The CVSS score of 3.7 indicates a low overall severity, and the EPSS score is not available. The flaw is not listed in the CISA KEV catalog. The likely attack vector is remote, accessed by a malicious server that presents a crafted certificate to a curl client over an insecure network. An attacker would need to control the server side or compromise a target host that connects to the malicious server; the exploitation does not require local code execution or elevated privileges on the client. Because the vulnerability exploits a certificate parsing bug, success hinges on the client performing the TLS handshake with a modified validity field.