CVE-2025-15079
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2026-01-08

Last updated on: 2026-01-20

Assigner: curl

Description
When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-08
Last Modified
2026-01-20
Generated
2026-05-27
AI Q&A
2026-01-08
EPSS Evaluated
2026-05-25
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
haxx curl From 7.58.0 (inc) to 8.18.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-297 The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability in libcurl affects SSH-based transfers using SCP or SFTP when a user specifies a known_hosts file for host verification. Despite specifying a particular known_hosts file, libcurl could mistakenly accept connections to hosts not listed in that file if those hosts were present in the libssh global known_hosts file. This happens because libssh's API falls back to a global known_hosts file if the host is not found in the user-specified file, leading to improper validation of host certificates (CWE-297). The issue affects libcurl versions 7.58.0 through 8.17.0 and was fixed in version 8.18.0. [1, 2]


How can this vulnerability impact me? :

This vulnerability can allow libcurl to accept SSH connections to unauthorized or unintended hosts during SCP or SFTP transfers if those hosts are present in the global known_hosts file but not in the user-specified known_hosts file. This could lead to potential man-in-the-middle attacks or unauthorized data transfers, compromising the security of SSH-based file transfers. [1, 2]


What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, you should upgrade libcurl to version 8.18.0 or later, which contains the fix. Alternatively, you can build curl with the libssh2 backend instead of libssh, or avoid using the SFTP or SCP protocols with vulnerable versions of libcurl (7.58.0 up to and including 8.17.0). [2]


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart