CVE-2026-9547

Name	CVE-2026-9547
Description	When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
curl (PTS)	bullseye	7.74.0-1.3+deb11u13	vulnerable
	bullseye (security)	7.74.0-1.3+deb11u16	vulnerable
	bookworm	7.88.1-10+deb12u15	vulnerable
	bookworm (security)	7.88.1-10+deb12u5	vulnerable
	trixie	8.14.1-2+deb13u4	vulnerable
	forky	8.20.0-5	vulnerable
	sid	8.21.0-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
curl	source	(unstable)	8.21.0~rc2-1	unimportant

Notes

https://curl.se/docs/CVE-2026-9547.html
Debian builds with --without-libssh --with-libssh2.
Introduced with: https://github.com/curl/curl/commit/507cf6a13db0375eadd4655b4c64710db29e9cf2 (curl-7_69_0)
Fixed by: https://github.com/curl/curl/commit/0b8dbbc63c98777e4584cb9fbd71df3464008ad1 (rc-8_21_0-1, curl-8_21_0)