CVE-2026-87865: knownhost callback mismatches key as missing
Published Oct 14, 2026
·Updated
knownhost callback mismatches key as missing
Other sources
When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback.
— Launchpad
Affected Software
10 affected componentsFixes available
debian/curl<=7.88.1-10+deb12u15, <=7.88.1-10+deb12u5, <=8.14.1-2+deb13u5, <=8.14.1-2+deb13u7, <=8.22.0-1
8.23.0-1
alpine/curl<8.23.0-r0
8.23.0-r0
alpine/curl<8.23.0-r0
8.23.0-r0
debian/curl*
debian/curl*
debian/curl*
ubuntu/curl<8.20.0-2ubuntu11.1
8.20.0-2ubuntu11.1
ubuntu/curl<8.18.0-1ubuntu2.8
8.18.0-1ubuntu2.8
All of the following
azurelinux/curl<8.11.1-13
8.11.1-13
Microsoft Azure Linux=3.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.23.0-1 - Upgrade
Upgrade
alpine/curlto a version that resolves this vulnerability.Fixed in 8.23.0-r0 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.20.0-2ubuntu11.1 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.18.0-1ubuntu2.8 - Upgrade
Upgrade
azurelinux/curlto a version that resolves this vulnerability.Fixed in 8.11.1-13
Event History
Oct 14, 2026
CVE Published
via OSV·06:00 AM
Data Sourced
via OSV·06:00 AM
DescriptionSeverityAffected Software
Oct 20, 2026
CVE Published
via MITRE·08:15 PM
Data Sourced
via MITRE·08:15 PM
DescriptionWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeakness
Oct 23, 2026
Data Sourced
via Microsoft·08:06 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·08:06 AM
Affected Software