{"id":"CVE-2026-87865","kind":"vulnerability","aliases":["CVE-2026-87865"],"related":[],"title":"libcurl: hashed known_hosts can misreport host key mismatch as missing","description":"When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated\ninitial entry can cause host key validation to report a key *mismatch* as a\n*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.","summary":"When libcurl uses libssh2 with a hashed known_hosts file, an unrelated initial entry can make host key validation report a key mismatch as a missing key to the CURLOPT_SSH_KEYFUNCTION callback. An attacker positioned to present a changed host key could be accepted by a callback that treats missing keys as new hosts.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["libcurl","libssh2","package","scp","sftp","ssh"],"not_affected_if":["libssh-backend","no-keyfunc-callback","no-ssh-transfers"],"how_to_check":"- Run `curl --version` and look for libssh2 in the features line.\n- Check whether the application sets CURLOPT_SSH_KEYFUNCTION and uses a hashed known_hosts file.","fix":"- Upgrade libcurl to a fixed release: unknown\n- Until patched, use strict host key checking with known fingerprints: unknown","status":"open","published_at":"2026-10-20T21:17:20+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T05:04:28+00:00","updated_at":"2026-10-25T05:04:28+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:04:28Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade libcurl to a fixed release: unknown\n- Until patched, use strict host key checking with known fingerprints: unknown","reach":"network","title":"libcurl: hashed known_hosts can misreport host key mismatch as missing","impact":"medium","summary":"When libcurl uses libssh2 with a hashed known_hosts file, an unrelated initial entry can make host key validation report a key mismatch as a missing key to the CURLOPT_SSH_KEYFUNCTION callback. An attacker positioned to present a changed host key could be accepted by a callback that treats missing keys as new hosts.","category":"package","nicknames":[],"who_cares":["libcurl","libssh2","ssh","sftp","scp"],"confidence":0.5,"needs_auth":"no","worst_case":"host key mismatch accepted as a missing key by callback","analyst_note":"Find the fixed libcurl version and advisory details at https://nvd.nist.gov/vuln/detail/CVE-2026-87865 and the curl project security page.","how_to_check":"- Run `curl --version` and look for libssh2 in the features line.\n- Check whether the application sets CURLOPT_SSH_KEYFUNCTION and uses a hashed known_hosts file.","needs_analyst":true,"not_affected_if":["libssh-backend","no-ssh-transfers","no-keyfunc-callback"],"who_is_affected":"Only applications that use libcurl with the libssh2 backend for SFTP or SCP, a hashed known_hosts file, and a CURLOPT_SSH_KEYFUNCTION callback that handles missing keys differently from mismatched keys. Applications using other SSH backends, or without a custom key callback, are less exposed. The sources do not give fixed versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000653,"input_tokens":3303,"output_tokens":645,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-87865':14A,17A 'accept':68B 'attack':58B 'callback':56B,71B,112C 'caus':94C 'chang':63B 'could':66B 'curlopt':53B,109C 'cve':12A,15A 'entri':37B,92C 'file':33B,88C 'hash':2A,30B,85C 'host':4A,7A,32B,40B,64B,78B,87C,95C 'initi':36B,91C 'key':8A,41B,45B,50B,65B,75B,96C,101C,106C 'keyfunct':55B,111C 'known':3A,31B,86C 'libcurl':1A,18B,25B,80C 'libssh2':19B,27B,82C 'make':39B 'mismatch':9A,46B,102C 'misreport':6A 'miss':11A,49B,74B,105C 'new':77B 'packag':20B 'posit':59B 'present':61B 'report':43B,99C 'scp':21B 'sftp':22B 'ssh':23B,54B,110C 'treat':73B 'unrel':35B,90C 'use':26B,81C 'valid':42B,97C","nicknames":[],"mitigations":[],"who_affected":"Only applications that use libcurl with the libssh2 backend for SFTP or SCP, a hashed known_hosts file, and a CURLOPT_SSH_KEYFUNCTION callback that handles missing keys differently from mismatched keys. Applications using other SSH backends, or without a custom key callback, are less exposed. The sources do not give fixed versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87865","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87865","severity":null,"published_at":"2026-10-20T21:17:20+00:00","modified_at":"2026-10-22T16:57:53+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}