When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file.
History

Thu, 08 Jan 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Thu, 08 Jan 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-297
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N'}


Thu, 08 Jan 2026 11:30:00 +0000

Type Values Removed Values Added
References

Thu, 08 Jan 2026 10:15:00 +0000

Type Values Removed Values Added
Description When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file.
Title libssh global known_hosts override
References

cve-icon MITRE

Status: PUBLISHED

Assigner: curl

Published:

Updated: 2026-01-08T14:46:47.042Z

Reserved: 2025-12-24T22:18:18.481Z

Link: CVE-2025-15079

cve-icon Vulnrichment

Updated: 2026-01-08T11:06:21.628Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-01-08T10:15:47.100

Modified: 2026-01-08T18:08:18.457

Link: CVE-2025-15079

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.