CVE-2026-87865
knownhost callback mismatches key as missing
N/A
Published: October 20, 2026 at 08:15 PM UTC
Updated: October 22, 2026 at 04:57 PM UTC
1 product affected across 1 vendorCurl
Using curl by curl?
Get instant alerts when new vulnerabilities affect curl - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 0.2%
Description
When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
7.69.17.70.07.71.07.71.17.72.07.73.07.74.07.75.07.76.07.76.17.77.07.78.07.79.07.79.17.80.07.81.07.82.07.83.07.83.17.84.07.85.07.86.07.87.07.88.07.88.18.0.08.0.18.1.08.1.18.1.28.10.08.10.18.11.08.11.18.12.08.12.18.13.08.14.08.14.18.15.08.16.08.17.08.18.08.19.08.2.08.2.18.20.08.21.08.22.08.3.08.4.08.5.08.6.08.7.08.7.18.8.08.9.08.9.1
Remediation
No guide yetNo remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.
References (3)
Source: cverecord
https://curl.se/docs/CVE-2026-87865.jsonSource: cverecord
https://curl.se/docs/CVE-2026-87865.htmlSource: cverecord
https://hackerone.com/reports/3975408Quick Info
StatusAWAITING ANALYSIS
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card