When doing SSH-based transfers using either SCP or SFTP, and setting the
known_hosts file, libcurl could still mistakenly accept connecting to hosts
*not present* in the specified file if they were added as recognized in the
libssh *global* known_hosts file.
Metrics
Affected Vendors & Products
References
History
Thu, 08 Jan 2026 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 08 Jan 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-297 | |
| Metrics |
cvssV3_1
|
Thu, 08 Jan 2026 11:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Thu, 08 Jan 2026 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file. | |
| Title | libssh global known_hosts override | |
| References |
|
Status: PUBLISHED
Assigner: curl
Published:
Updated: 2026-01-08T14:46:47.042Z
Reserved: 2025-12-24T22:18:18.481Z
Link: CVE-2025-15079
Updated: 2026-01-08T11:06:21.628Z
Status : Awaiting Analysis
Published: 2026-01-08T10:15:47.100
Modified: 2026-01-08T18:08:18.457
Link: CVE-2025-15079
No data.
OpenCVE Enrichment
No data.