CVE-2026-87865

HighCVSS 7.4/10Last modified Oct 30, 2026

Description

When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-295

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
curl	curl	>= 8.22.0, <= 8.22.0; >= 8.21.0, <= 8.21.0; >= 8.20.0, <= 8.20.0; >= 8.19.0, <= 8.19.0; >= 8.18.0, <= 8.18.0; >= 8.17.0, <= 8.17.0; >= 8.16.0, <= 8.16.0; >= 8.15.0, <= 8.15.0; >= 8.14.1, <= 8.14.1; >= 8.14.0, <= 8.14.0; >= 8.13.0, <= 8.13.0; >= 8.12.1, <= 8.12.1; >= 8.12.0, <= 8.12.0; >= 8.11.1, <= 8.11.1; >= 8.11.0, <= 8.11.0; >= 8.10.1, <= 8.10.1; >= 8.10.0, <= 8.10.0; >= 8.9.1, <= 8.9.1; >= 8.9.0, <= 8.9.0; >= 8.8.0, <= 8.8.0

References

Timeline

Published: Oct 20, 2026
Last modified: Oct 30, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-878669.1When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS CVE-2026-878696.1The Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up CVE-2026-87878.8The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.1.CVE-2026-878706.4The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters (interval, for CVE-2026-878726.8A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection. The shared OCAPI request help CVE-2026-878748.1A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation states that records a CVE-2026-878754.3The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, result CVE-2026-878763.0Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validatio CVE-2026-878777.7zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream CVE-2026-878786.3Linux binaries have executable stack attribute enabled. The following products are affected: Acronis Cyber Protect 17 (Linux) before build 4 CVE-2026-878795.9Sensitive information disclosure due to improper token validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Win CVE-2026-87887.3Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections. The values from the set_add method were not checked for newli