Executive brief
libcurl is a widely-used library for transferring files over network protocols like SFTP and SCP. When configured with a custom known_hosts file to validate SSH server identities, the library could bypass this security check by accepting connections to servers that weren't in the specified file, if they were previously trusted in the system-wide known_hosts database. This undermines the intended host verification security control and could enable man-in-the-middle attacks.
Technical details
CVE-2025-15079 is a host validation bypass affecting libcurl versions 7.58.0 through 8.17.0 when built with the libssh backend (not libssh2). When users set a custom known_hosts file for SFTP/SCP transfers to restrict which hosts are trusted, libcurl's use of the libssh library unexpectedly falls back to the system-wide global known_hosts file as a fallback if a host is not found in the specified file. This is a CWE-297 improper certificate/host validation issue. The attack vector is network-based; no user interaction or authentication is required—an attacker performing a man-in-the-middle attack against SSH traffic could connect if their server was previously accepted globally. The fix forces libcurl to use only the specified known_hosts file by setting both libssh's known_hosts paths identically. Patches are available in curl versions 8.14.2+, 8.16.1+, and 8.18.0+.
Affected products
- curl curl 7.58.0 through 8.17.0 (except 8.14.2+, 8.16.1+)
Timeline
- 2026-01-07: disclosed: curl 8.18.0 released with fix
- 2025-12-24: other: Vulnerability reported to curl project
- 2025-12-30: other: Distros@openwall contacted for coordinated disclosure