When curl is compiled with the wolfSSL backend, the client may validate a pinned public key hash against a key that the TLS peer does not actually present. During the TLS handshake, wolfSSL performs standard validation, but curl subsequently re‑parses the same certificate. A crafted certificate containing a manipulated validity length field causes curl to extract a different embedded key, which then matches the pinned key hash, leading the client to incorrectly authorize the pin. The consequence is that an attacker can impersonate a legitimate server, enabling man‑in‑the‑middle attacks and data manipulation. This weakness is a CWE‑295 authentication flaw involving certificate validation.

The affected product is the open‑source curl client when compiled with the wolfSSL backend. No specific version ranges are provided in the advisory, so all builds that include the wolfSSL backend and have the certificate parsing bug are potentially vulnerable. The vulnerability applies to any system that connects to a malicious server using this configuration.

The CVSS score of 9.1 indicates a high overall severity, and the EPSS score is < 1%. The flaw is not listed in the CISA KEV catalog. The likely attack vector is remote, accessed by a malicious server that presents a crafted certificate to a curl client over an insecure network. An attacker would need to control the server side or compromise a target host that connects to the malicious server; the exploitation does not require local code execution or elevated privileges on the client. Because the vulnerability exploits a certificate parsing bug, success hinges on the client performing the TLS handshake with a modified validity field.