Vulnerability in libcurl affecting SCP and SFTP connections
CVE-2026-9547

7.4HIGH

Key Information:

Vendor

Curl

Status
Curl
Vendor
CVE Published:
3 July 2026

What is CVE-2026-9547?

A security vulnerability exists in libcurl when handling connections over SCP and SFTP protocols. It occurs due to the mishandling of server host key types that do not match the expected keys stored in the known_hosts file. This flaw allows a libcurl-based application to connect to an untrusted server without raising an alert, potentially exposing users to man-in-the-middle attacks. Proper validation mechanisms are essential to prevent unauthorized access and protect data integrity during file transfers.

Affected Version(s)

curl 8.20.0

curl 8.19.0

curl 8.18.0

References

https://curl.se/docs/CVE-2026-9547.json
https://curl.se/docs/CVE-2026-9547.html
https://hackerone.com/reports/3751712

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joshua Rogers (Aisle Research)
Joshua Rogers (Aisle Research)
.