CVE-2026-87865
knownhost callback mismatches key as missing
Project curl Security Advisory, October 14 2026 Permalink
VULNERABILITY
When libcurl uses libssh2 with a hashed known_hosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPT_SSH_KEYFUNCTION callback.
INFO
A network attacker who controls or intercepts the reached SSH endpoint can make an already pinned host appear genuinely new to a trust-on-first-use callback. libcurl then authenticates to the hostile endpoint; in the proof, the server receives the configured SSH password and libcurl accepts attacker-controlled SFTP data. The default callback and curl command-line tool are not claimed affected.
This problem only affects libcurl built with the libssh2 backend for SFTP and SCP transfers.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-87865 to this issue.
CWE-295: Improper Certificate Validation
Severity: Low
AFFECTED VERSIONS
- Affected versions: curl 7.69.1 to and including 8.22.0
- Not affected versions: curl < 7.69.1 and >= 8.23.0
- Not affected versions: curl >= 8.20.2 in the 8.20.X branch
- Not affected versions: curl >= 8.16.2 in the 8.16.X branch
- Not affected versions: curl >= 8.14.3 in the 8.14.X branch
- Introduced-in: https://github.com/curl/curl/commit/e96fe70cabcb3a5a009821d
libcurl is used by many applications, but not always advertised as such!
This flaw does not affect the curl command line tool.
SOLUTION
RECOMMENDATIONS
A - Upgrade curl to version 8.23.0
B - Apply the patch to your local version
C - Avoid the libssh2 backend for SFTP and SCP
TIMELINE
This issue was reported to the curl project on August 28, 2026.
curl 8.23.0 was released on October 14, 2026, coordinated with the publication of this advisory.
CREDITS
- Reported-by: Bobbeh Rhino
- Patched-by: Bobbeh Rhino
Thanks a lot!