CVE-2025-15079
BaseFortify
Publication date: 2026-01-08
Last updated on: 2026-01-20
Assigner: curl
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| haxx | curl | From 7.58.0 (inc) to 8.18.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-297 | The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in libcurl affects SSH-based transfers using SCP or SFTP when a user specifies a known_hosts file for host verification. Despite specifying a particular known_hosts file, libcurl could mistakenly accept connections to hosts not listed in that file if those hosts were present in the libssh global known_hosts file. This happens because libssh's API falls back to a global known_hosts file if the host is not found in the user-specified file, leading to improper validation of host certificates (CWE-297). The issue affects libcurl versions 7.58.0 through 8.17.0 and was fixed in version 8.18.0. [1, 2]
How can this vulnerability impact me? :
This vulnerability can allow libcurl to accept SSH connections to unauthorized or unintended hosts during SCP or SFTP transfers if those hosts are present in the global known_hosts file but not in the user-specified known_hosts file. This could lead to potential man-in-the-middle attacks or unauthorized data transfers, compromising the security of SSH-based file transfers. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade libcurl to version 8.18.0 or later, which contains the fix. Alternatively, you can build curl with the libssh2 backend instead of libssh, or avoid using the SFTP or SCP protocols with vulnerable versions of libcurl (7.58.0 up to and including 8.17.0). [2]