When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | Jun 18, 2026 | Jan 8, 2026 |
| Amazon Linux Ami 2 | — | Upgrade curl-debuginfoUpgrade libcurlUpgrade curlUpgrade libcurl-devel | May 20, 2026 | May 20, 2026 |
| Freebsd | — | Upgrade curl | Mar 12, 2026 | Mar 11, 2026 |
| Huawei Euleros 2_0_sp10 | — | Upgrade curlUpgrade libcurl | Mar 17, 2026 | Mar 16, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libcurlUpgrade curl | Mar 17, 2026 | Mar 16, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade curlUpgrade libcurl | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Jan 7, 2026 |
| Ubuntu | — | Upgrade libcurl3t64-gnutlsUpgrade libcurl4-openssl-devUpgrade libcurl4-nss-devUpgrade libcurl4t64Upgrade libcurl3-nssUpgrade libcurl4-gnutls-devUpgrade libcurl4Upgrade curlUpgrade libcurl3-gnutls | Feb 26, 2026 | Feb 25, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jan 8, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub