UBUNTU-CVE-2026-87865: Ubuntu/curl vulnerability

Q: What conditions are required for this issue to occur?

libcurl must be using libssh2 with a hashed known_hosts file. The issue is triggered when that file contains an unrelated initial entry and host key validation encounters a key mismatch.

Q: What is the practical effect on applications using CURLOPT_SSH_KEYFUNCTION?

The callback can be told that the host key is missing when the actual condition is a host key mismatch. Applications that make different trust decisions for missing keys versus mismatched keys may therefore handle the validation result incorrectly.

Published Oct 14, 2026

Updated

When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback.

Affected Software

2 affected componentsFixes available

ubuntu/curl<8.20.0-2ubuntu11.1

8.20.0-2ubuntu11.1

ubuntu/curl<8.18.0-1ubuntu2.8

8.18.0-1ubuntu2.8

Event History

Oct 14, 2026

CVE Published

via OSV·06:00 AM

Data Sourced

via OSV·06:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What conditions are required for this issue to occur?

libcurl must be using libssh2 with a hashed known_hosts file. The issue is triggered when that file contains an unrelated initial entry and host key validation encounters a key mismatch.

What is the practical effect on applications using CURLOPT_SSH_KEYFUNCTION?

The callback can be told that the host key is missing when the actual condition is a host key mismatch. Applications that make different trust decisions for missing keys versus mismatched keys may therefore handle the validation result incorrectly.

UBUNTU-CVE-2026-87865: Ubuntu/curl vulnerability

Affected Software

Event History

Frequently Asked Questions

What conditions are required for this issue to occur?

What is the practical effect on applications using CURLOPT_SSH_KEYFUNCTION?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for this issue to occur?

What is the practical effect on applications using CURLOPT_SSH_KEYFUNCTION?