Hi Jake,
I don’t think there’s a documented restriction on using port 8080. WordPress includes the site URL in the User-Agent for outgoing requests, so in your case it sends something like:
WordPress/6.9; http://localhost:8080/
Since the request works from the same server when only the port in the User-Agent is changed, this looks like a false positive in a firewall or filtering rule on the WordPress.org side. The 434 response also suggests that the request is reaching WordPress.org but is being rejected before the API handles it normally.
Using another port seems like a reasonable workaround for now. It may also be worth reporting it on WordPress Meta Trac with the curl example and response headers, as that should make the rule easier for them to identify.
