Description
A flaw was found in curl. When libcurl is built with the libssh2 backend and uses a hashed known-hosts file, host key verification can mistakenly report a key mismatch as a missing key to custom verification callbacks. A remote attacker who intercepts or controls the Secure Shell (SSH) connection can exploit this flaw to make a previously pinned server appear as a new host. As a result, the application may inadvertently authenticate to an untrusted server, leading to credential exposure and the receipt of malicious data.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
No data.
No data.
No data available yet.
Remediation
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 Ubuntu USN |
USN-8927-1 | curl vulnerabilities |
References
History
Sat, 17 Oct 2026 00:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in curl. When libcurl is built with the libssh2 backend and uses a hashed known-hosts file, host key verification can mistakenly report a key mismatch as a missing key to custom verification callbacks. A remote attacker who intercepts or controls the Secure Shell (SSH) connection can exploit this flaw to make a previously pinned server appear as a new host. As a result, the application may inadvertently authenticate to an untrusted server, leading to credential exposure and the receipt of malicious data. | |
| Title | curl: curl: knownhost callback mismatches key as missing | |
| Weaknesses | CWE-295 | |
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
Subscriptions
No data.
MITRE
No data.
Vulnrichment
No data.
NVD
No data.
Redhat
OpenCVE Enrichment
Updated: 2026-10-17T02:15:14Z
Weaknesses
-
CWE-295
Improper Certificate Validation