28 matches found
CVE-2026-86410
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...
EUVD-2026-105275
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...
CVE-2026-86410
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...
CVE-2026-86410
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...
Ubuntu: USN-8927-1 (CVE-2026-86410): curl vulnerabilities
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...
SUSE CVE-2026-86410
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...
CVE-2026-86410
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect. This means --knownhosts, --hostpubsha256, and --hostpubmd5 are never installed when the initial URL is HTTPS. If...
UBUNTU-CVE-2026-86410
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect. This means --knownhosts, --hostpubsha256, and --hostpubmd5 are never installed when the initial URL is HTTPS. If...
EulerOS 2.0 SP15 : curl (EulerOS-SA-2026-3969)
According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A use-after-free vulnerability exists in libcurl when an applicationx000D configures an HTTP/2 stream-dependency tree via CURLOPTSTREAMDEPENDS orx00...
EulerOS 2.0 SP15 : curl (EulerOS-SA-2026-3903)
According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A use-after-free vulnerability exists in libcurl when an applicationx000D configures an HTTP/2 stream-dependency tree via CURLOPTSTREAMDEPENDS orx00...
Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2026-2132)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2132 advisory. A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream- dependency tree via CURLOPTSTREAMDEPENDS or CURLOPTSTREAMDEPENDSE, subsequently invokes...
curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP
A flaw was found in curl. When a user invokes curl with a schemeless URL and specifies SFTP SSH File Transfer Protocol or SCP Secure Copy Protocol as the default protocol, the tool layer fails to initialize critical SSH security options. This bypasses host verification, allowing curl to connect t...
PYSEC-2026-3627 AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands
Summary The AWS Command Line Interface AWS CLI is a unified tool to manage AWS services from the command line. An issue exists where the EMR SSH helper commands aws emr ssh, aws emr socks, aws emr put, aws emr get passed StrictHostKeyChecking=no to the underlying SSH client, disabling host key...
JLSEC-2026-1202 When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a...
When a user invokes curl using a schemeless URL combined with --proto-default sftp or scp, a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like...
OESA-2026-2988 curl security update
cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPTSTREAMDEPENDS or...
CVE-2026-58065 Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key verification
The Apache Airflow Git provider runs its git-over-SSH operations with StrictHostKeyChecking=no by default, disabling SSH host-key verification. An attacker who can intercept the network path between an Airflow worker and the Git server can impersonate the server man-in-the-middle, capturing the S...
USN-8525-1 curl vulnerabilities
Harry Sintonen discovered that curl incorrectly handled credentials when following HTTP redirects in conjunction with .netrc files. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS...
USN-8525-1: curl vulnerabilities
Harry Sintonen discovered that curl incorrectly handled credentials when following HTTP redirects in conjunction with .netrc files. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS...
CVE-2026-12064
When a user invokes curl using a schemeless URL combined with --proto-default sftp or scp, a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like...
AZL-91812 CVE-2026-12064 affecting package curl for versions less than 8.11.1-10
When a user invokes curl using a schemeless URL combined with --proto-default sftp or scp, a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like...