Live › vulnerability › CVE-2026-87865
Go to dashboardWhen libcurl uses libssh2 with a hashed known_hosts file, an unrelated initial entry can make host key validation report a key mismatch as a missing key to the CURLOPT_SSH_KEYFUNCTION callback. An attacker positioned to present a changed host key could be accepted by a callback that treats missing keys as new hosts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only applications that use libcurl with the libssh2 backend for SFTP or SCP, a hashed known_hosts file, and a CURLOPT_SSH_KEYFUNCTION callback that handles missing keys differently from mismatched keys. Applications using other SSH backends, or without a custom key callback, are less exposed. The sources do not give fixed versions.
No product ranges from the sources yet.
curl --version and look for libssh2 in the features line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When libcurl uses libssh2 with a hashed known_hosts file, an unrelated
initial entry can cause host key validation to report a key mismatch as a
missing key to the CURLOPT_SSH_KEYFUNCTION callback.
This page as .md · .json · in your agent: get_signal("CVE-2026-87865")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.