1411 matches found
CVE-2026-87865
When libcurl uses libssh2 with a hashed "knownhosts" file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the "CURLOPTSSHKEYFUNCTION" callback...
CVE-2026-87865
When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...
CVE-2026-87865
A host key validation vulnerability exists in libcurl when using libssh2 with a hashed known_hosts file. An unrelated initial entry can cause the system to incorrectly report a key mismatch as a missing key to the CURLOPT_SSH_KEYFUNCTION callback. This issue impacts various software packages, inc...
Curl encryption vulnerability
The curl version 8.22.0 and earlier have an encryption-related vulnerability. This vulnerability arises when libcurl uses libssh2 to process the hash of the knownhosts file. In this case, unrelated initial entries can cause host key verification to falsely report a key mismatch as a key absence...
Ubuntu: USN-8927-1 (CVE-2026-87865): curl vulnerabilities
When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...
SUSE CVE-2026-87865
When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...
CVE-2026-87865
A flaw was found in curl. When libcurl is built with the libssh2 backend and uses a hashed known-hosts file, host key verification can mistakenly report a key mismatch as a missing key to custom verification callbacks. A remote attacker who intercepts or controls the Secure Shell SSH connection c...
Astra Linux – Vulnerability in libgit2
libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Previous versions of libgit2 required the caller to set the certificatecheck field of the libgit2’s...
Astra Linux – vulnerability in libssh2
An issue was found in the libssh2packetadd function within libssh2 1.10.0; it allows attackers to access out-of-bounds memory...
Improper Certificate Validation
Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the knownhost callback process. An attacker can cause the application to trust an unverified server by intercepting SSH network traffic and exploiting the mishandling of host key verification. This is...
curl: curl: knownhost callback mismatches key as missing
A flaw was found in curl. When libcurl is built with the libssh2 backend and uses a hashed known-hosts file, host key verification can mistakenly report a key mismatch as a missing key to custom verification callbacks. A remote attacker who intercepts or controls the Secure Shell SSH connection c...
CURL-CVE-2026-87865 knownhost callback mismatches key as missing
When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...
knownhost callback mismatches key as missing
When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...
curl: CVE-2026-111482: libssh2 knownhosts prefix match
AI Disclaimer: I've written this report with the help of AI, please feel free to let me know if I made a mistake, I've read the final revision of this report a few times to ensure it was solid but my understanding of the inner workings of curl and libssh is where I can fall short. Summary:...
CVE-2026-87865
When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...
UBUNTU-CVE-2026-87865
When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...
PT-2026-114421
Name of the Vulnerable Software and Affected Versions libcurl versions prior to 8.23.0-1.1 Description When libcurl utilizes libssh2 with a hashed known hosts file, an unrelated initial entry can lead to incorrect host key validation. Specifically, the system may report a key mismatch as a missin...
EulerOS 2.0 SP11 : libssh2 (EulerOS-SA-2026-4250)
According to the versions of the libssh2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftpopen function in src/sftp.c that allows a...
EulerOS 2.0 SP13 : libssh2 (EulerOS-SA-2026-4156)
According to the versions of the libssh2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libssh2 through 1.11.1 grows its publickey list with SSH2REALLOC but does not zero-initialize new entries before parsing populates them, so a par...
EulerOS 2.0 SP11 : libssh2 (EulerOS-SA-2026-4341)
According to the versions of the libssh2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftpopen function in src/sftp.c that allows a...