JLSEC-2026-430 Medium 5.3

When doing SSH-based transfers using either SCP or SFTP, and setting the `known_hosts` file, libcurl...

JLSEC Published: May 4, 2026
Modified: Jul 23, 2026
Severity: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected Packages: CURL_jll < 8.20.0+0
LibCURL_jll < 8.18.0+0
Upstream: CVE-2025-15079 GHSA-7q9p-cx8r-rh2q EUVD-2026-1575

When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file.

References

http://www.openwall.com/lists/oss-security/2026/01/07/6
https://curl.se/docs/CVE-2025-15079.html
https://curl.se/docs/CVE-2025-15079.json
https://github.com/advisories/GHSA-7q9p-cx8r-rh2q
https://hackerone.com/reports/3477116
https://nvd.nist.gov/vuln/detail/CVE-2025-15079