CVE-2026-87865: knownhost callback mismatches key as missing
Published Oct 20, 2026
·Updated
Last updated 14 October 2026
Other sources
When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback.
— MITRE
Affected Software
1 affected componentFixes available
debian/curl<=7.88.1-10+deb12u15, <=7.88.1-10+deb12u5, <=8.14.1-2+deb13u5, <=8.14.1-2+deb13u7, <=8.22.0-1
8.23.0-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.23.0-1
Event History
Oct 14, 2026
CVE Published
via Ubuntu·02:50 PM
Data Sourced
via Ubuntu·02:50 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·02:50 PM
DescriptionAffected Software
Oct 20, 2026
CVE Published
via MITRE·08:15 PM
Data Sourced
via MITRE·08:15 PM
DescriptionWeakness