CVE-2026-87865None▾ SunlitWhen libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
When libcurl uses libssh2 with a hashed known_hosts file, an unrelated
initial entry can cause host key validation to report a key mismatch as a
missing key to the CURLOPT_SSH_KEYFUNCTION callback.
curl >= 8.22.0 <= 8.22.0curl >= 8.21.0 <= 8.21.0curl >= 8.20.0 <= 8.20.0curl >= 8.19.0 <= 8.19.0curl >= 8.18.0 <= 8.18.0curl >= 8.17.0 <= 8.17.0curl >= 8.16.0 <= 8.16.0curl >= 8.15.0 <= 8.15.0curl >= 8.14.1 <= 8.14.1curl >= 8.14.0 <= 8.14.0curl >= 8.13.0 <= 8.13.0curl >= 8.12.1 <= 8.12.1curl >= 8.12.0 <= 8.12.0curl >= 8.11.1 <= 8.11.1curl >= 8.11.0 <= 8.11.0curl >= 8.10.1 <= 8.10.1curl >= 8.10.0 <= 8.10.0curl >= 8.9.1 <= 8.9.1curl >= 8.9.0 <= 8.9.0curl >= 8.8.0 <= 8.8.0curl >= 8.7.1 <= 8.7.1curl >= 8.7.0 <= 8.7.0curl >= 8.6.0 <= 8.6.0curl >= 8.5.0 <= 8.5.0curl >= 8.4.0 <= 8.4.0curl >= 8.3.0 <= 8.3.0curl >= 8.2.1 <= 8.2.1curl >= 8.2.0 <= 8.2.0curl >= 8.1.2 <= 8.1.2curl >= 8.1.1 <= 8.1.1curl >= 8.1.0 <= 8.1.0curl >= 8.0.1 <= 8.0.1curl >= 8.0.0 <= 8.0.0curl >= 7.88.1 <= 7.88.1curl >= 7.88.0 <= 7.88.0curl >= 7.87.0 <= 7.87.0curl >= 7.86.0 <= 7.86.0curl >= 7.85.0 <= 7.85.0curl >= 7.84.0 <= 7.84.0curl >= 7.83.1 <= 7.83.1curl >= 7.83.0 <= 7.83.0curl >= 7.82.0 <= 7.82.0curl >= 7.81.0 <= 7.81.0curl >= 7.80.0 <= 7.80.0curl >= 7.79.1 <= 7.79.1curl >= 7.79.0 <= 7.79.0curl >= 7.78.0 <= 7.78.0curl >= 7.77.0 <= 7.77.0curl >= 7.76.1 <= 7.76.1curl >= 7.76.0 <= 7.76.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-87866NonewolfSSL public-key pinning bypass
CVE-2024-8096Medium· 6.5When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the respon…
CVE-2024-2379Medium· 6.3libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL
CVE-2022-27782High· 7.5libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse i…
CVE-2021-22926High· 7.5libcurl-using applications can ask for a specific client certificate to be used in a transfer
CVE-2026-4873Medium· 5.9A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool