CVE-2026-87865

knownhost callback mismatches key as missing

View on CVE.org
Published Oct 20, 2026 CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Description
When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated
initial entry can cause host key validation to report a key *mismatch* as a
*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Ubuntu USN Ubuntu USN USN-8927-1 curl vulnerabilities
Ubuntu USN Ubuntu USN USN-8927-2 curl vulnerabilities
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'}

 cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}
Type Values Removed Values Added
Description A flaw was found in curl. When libcurl is built with the libssh2 backend and uses a hashed known-hosts file, host key verification can mistakenly report a key mismatch as a missing key to custom verification callbacks. A remote attacker who intercepts or controls the Secure Shell (SSH) connection can exploit this flaw to make a previously pinned server appear as a new host. As a result, the application may inadvertently authenticate to an untrusted server, leading to credential exposure and the receipt of malicious data. When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.
Title curl: curl: knownhost callback mismatches key as missing knownhost callback mismatches key as missing
References
Type Values Removed Values Added
First Time appeared Curl
Curl curl
Vendors & Products Curl
Curl curl
Type Values Removed Values Added
Description A flaw was found in curl. When libcurl is built with the libssh2 backend and uses a hashed known-hosts file, host key verification can mistakenly report a key mismatch as a missing key to custom verification callbacks. A remote attacker who intercepts or controls the Secure Shell (SSH) connection can exploit this flaw to make a previously pinned server appear as a new host. As a result, the application may inadvertently authenticate to an untrusted server, leading to credential exposure and the receipt of malicious data.
Title curl: curl: knownhost callback mismatches key as missing
Weaknesses CWE-295
References
Metrics threat_severity

None

 cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'}

threat_severity

Low
Weaknesses

Sources

Status
PUBLISHED
Assigner
curl
Published
Updated
Oct 30, 2026, 12:08 PM
Reserved
Sep 9, 2026, 1:17 PM

View source JSON

Updated
Oct 30, 2026, 12:05 PM

JSON

Status
Awaiting Analysis
Published
Oct 20, 2026, 9:17 PM
Modified
Oct 30, 2026, 12:16 PM

View source JSON

Severity
Low
Public date
Oct 14, 2026, 12:00 PM

View source Bugzilla JSON

Updated
Oct 30, 2026, 2:15 PM

JSON