A flaw in the curl commanda line tool's logic makes it only set SSH host
verification options when interacting directly using SFTP or SCP, and not as a
result of following a redirect.

* INFO

This means `--knownhosts`, `--hostpubsha256`, and `--hostpubmd5` are never
installed when the initial URL is HTTPS. If `--location` and
`--proto-redir +sftp` is used and the server returns a `Location: sftp://example.com`
redirect, the SFTP connection proceeds without any of the user's requested SSH host
verification methods. It should be noted that following and allowing redirects to
SFTP or SCP is rare.

This problem is similar, but not identical, to
[CVE-2026-12064](https://curl.se/docs/CVE-2026-12064.html).

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-86410 to this issue.

CWE-297: Improper Validation of Certificate with Host Mismatch

Severity: Low

** AFFECTED VERSIONS

- Affected versions: curl 7.81.0 to and including 8.22.0
- Not affected versions: curl < 7.81.0 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/

curl is used by many applications, but not always advertised as such!

This flaw is only affecting the curl command line tool, not libcurl.

** SOLUTION

- Fixed-in: https://github.com/curl/curl/commit/6ae9befb2fb6bdfdb5fc11fdf76b

** TIMELINE

This issue was reported to the curl project on August 27, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

** CREDITS

- Reported-by: Stanislav Fort (Aisle Research)
- Patched-by: Daniel Stenberg