CVE-2025-15079
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2026-01-08

Last updated on: 2026-01-20

Assigner: curl

Description
When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-08
Last Modified
2026-01-20
Generated
2026-06-16
AI Q&A
2026-01-08
EPSS Evaluated
2026-06-14
NVD
CVE-2025-15079
EUVD
EUVD-2026-1575
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
haxx curl From 7.58.0 (inc) to 8.18.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-297 The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in libcurl affects SSH-based transfers using SCP or SFTP when a user specifies a known_hosts file for host verification. Despite specifying a particular known_hosts file, libcurl could mistakenly accept connections to hosts not listed in that file if those hosts were present in the libssh global known_hosts file. This happens because libssh's API falls back to a global known_hosts file if the host is not found in the user-specified file, leading to improper validation of host certificates (CWE-297). The issue affects libcurl versions 7.58.0 through 8.17.0 and was fixed in version 8.18.0. [1, 2]

Impact Analysis

This vulnerability can allow libcurl to accept SSH connections to unauthorized or unintended hosts during SCP or SFTP transfers if those hosts are present in the global known_hosts file but not in the user-specified known_hosts file. This could lead to potential man-in-the-middle attacks or unauthorized data transfers, compromising the security of SSH-based file transfers. [1, 2]

Mitigation Strategies

To mitigate this vulnerability, you should upgrade libcurl to version 8.18.0 or later, which contains the fix. Alternatively, you can build curl with the libssh2 backend instead of libssh, or avoid using the SFTP or SCP protocols with vulnerable versions of libcurl (7.58.0 up to and including 8.17.0). [2]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-15079. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart