knownhost callback mismatches key as missing
============================================

Project curl Security Advisory, October 14 2026
[Permalink](https://curl.se/docs/CVE-2026-87865.html)

VULNERABILITY
-------------

When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated
initial entry can cause host key validation to report a key *mismatch* as a
*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.

INFO
----

A network attacker who controls or intercepts the reached SSH endpoint can
make an already pinned host appear genuinely new to a trust-on-first-use
callback. libcurl then authenticates to the hostile endpoint; in the proof,
the server receives the configured SSH password and libcurl accepts
attacker-controlled SFTP data. The default callback and curl command-line tool
are not claimed affected.

This problem only affects libcurl built with the libssh2 backend for SFTP and
SCP transfers.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-87865 to this issue.

CWE-295: Improper Certificate Validation

Severity: Low

AFFECTED VERSIONS
-----------------

- Affected versions: curl 7.69.1 to and including 8.22.0
- Not affected versions: curl < 7.69.1 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/e96fe70cabcb3a5a009821d

libcurl is used by many applications, but not always advertised as such!

This flaw does not affect the curl command line tool.

SOLUTION
------------

- Fixed-in: https://github.com/curl/curl/commit/323c184b6bdf5b1988a10c0a61560

RECOMMENDATIONS
--------------

 A - Upgrade curl to version 8.23.0

 B - Apply the patch to your local version

 C - Avoid the libssh2 backend for SFTP and SCP

TIMELINE
--------

This issue was reported to the curl project on August 28, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Bobbeh Rhino
- Patched-by: Bobbeh Rhino

Thanks a lot!