DEBIAN-CVE-2026-86410

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...

AZL-109962 CVE-2026-86410 affecting package curl 8.11.1-11

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...

AZL-110295 CVE-2026-86410 affecting package tensorflow 2.16.1-11

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...

AZL-110232 CVE-2026-86410 affecting package rust 1.96.1-2

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...

ALPINE-CVE-2026-86410

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...

AZL-110169 CVE-2026-86410 affecting package rust 1.75.0-31

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...

CVE-2026-86410

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...

CVE-2026-87865

When libcurl uses libssh2 with a hashed "knownhosts" file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the "CURLOPTSSHKEYFUNCTION" callback...

CVE-2026-87865 knownhost callback mismatches key as missing

When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...

EUVD-2026-105312

When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...

CVE-2026-87865

When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...

CVE-2026-87865

When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...

CVE-2026-87865

A host key validation vulnerability exists in libcurl when using libssh2 with a hashed known_hosts file. An unrelated initial entry can cause the system to incorrectly report a key mismatch as a missing key to the CURLOPT_SSH_KEYFUNCTION callback. This issue impacts various software packages, inc...

CVE-2026-86410

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...

EUVD-2026-105275

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...

CVE-2026-86410 redirect to SFTP or SCP bypasses host verification

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...

CVE-2026-86410

A logic flaw in the curl command line tool causes it to fail to set SSH host verification options when following a redirect to SFTP or SCP URLs. While host verification is correctly applied during direct interaction with these protocols, the failure to apply it during redirects could allow an att...

CVE-2026-86410

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...

CVE-2026-86410

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...

GHSA-GX76-C99X-2C96 AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

Summary A subdomain can remove the Host-Only flag from an existing cookie to a parent domain. Impact A user accessing untrusted subdomains could see their Host-Only protections stripped from cookies. Given most usecases won't reflect these cookies to a browser, the impact is limited...