CVE-2026-87865

A flaw was found in curl. When libcurl is built with the libssh2 backend and uses a hashed known-hosts file, host key verification can mistakenly report a key mismatch as a missing key to custom verification callbacks. A remote attacker who intercepts or controls the Secure Shell (SSH) connection can exploit this flaw to make a previously pinned server appear as a new host. As a result, the application may inadvertently authenticate to an untrusted server, leading to credential exposure and the receipt of malicious data.

This vulnerability is assessed as Low impact because exploitation requires a specialized non-default configuration and does not affect standard curl command-line usage. The issue is restricted to custom applications that consume libcurl compiled with libssh2 and explicitly configure a custom host key callback alongside hashed host records. Because trust-on-first-use callback logic must be custom-implemented and an attacker must be able to intercept SSH network traffic, default system installations face minimal operational risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.