CVE-2026-9547 | BDVDB-2026-345382 Detail

Description#

When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-07-03Record published in the CVE List.
2. Version 22026-09-15Most recent update recorded in the CVE List.