cyfenced.com →

[ CVE-2026-87865 · Published 20 Oct 2026 ]

Vulnerability in curl

Not scored yet EPSS <1%2 agency advisoriesNo fix listed yet

[ Description ]Official description

When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

  • CERT-FRCERTFR-2026-AVI-1307

    Multiple vulnerabilities in Curl Translated from French

    Multiple vulnerabilities have been discovered in Curl. Some of them allow an attacker to cause remote arbitrary code execution, remote denial of service and a breach of data confidentiality.

    CVE-2026-94265CVE-2026-87863CVE-2026-107928+23 more CVEs
  • BSI CERT-BundWID-SEC-2026-3904

    cURL: Multiple vulnerabilities Translated from German

    CVE-2026-87861CVE-2026-86412CVE-2026-92391+20 more CVEs

[ References ]References