CVE-2026-9547

When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.

Scoring

Severity

HIGH

CVSS base score

7.4

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS probability

0.33%

CWE

CWE-297

Published

2026-07-03

Last modified

2026-09-17

Affected products

• curl curl
• curl curl
• curl curl
• curl curl
• curl curl
• curl curl
• curl curl
• curl curl

Weakness type

• CWE-297

Related vulnerabilities

• CVE-2020-11050 — Improper Validation of Certificate with Host Mismatch in Java-WebSocket
• CVE-2021-21385 — Disabled hostname verification and accepting self-signed certificates
• CVE-2025-3501 — Org.keycloak.protocol.services: keycloak hostname verification
• CVE-2018-10936 — A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check t
• CVE-2022-32153 — Splunk Enterprise lacked TLS host name validation
• CVE-2026-59638 — JSSE hostname verifier CN-fallback enabled by default despite documented opt-in
• CVE-2026-92943 — Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python
• CVE-2026-84197 — In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from

Markdown version · Browse all CVEs