Is CVE-2025-15079 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-15079 being exploited in the wild.

How severe is CVE-2025-15079?

Medium severity, with a CVSS score of 5.3, published 8 January 2026.

Which products and versions are affected?

curl curl 7.58.0 through 8.17.0 (except 8.14.2+, 8.16.1+).

Is there a fix for CVE-2025-15079?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-15079 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-15079?

Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-15079: curl libssh global known_hosts override in SFTP/SCP

CVE-2025-15079 · Severity: medium · CVSS 5.3 · Published 2026-01-08

libcurl is a widely-used library for transferring files over network protocols like SFTP and SCP. When configured with a custom known_hosts file to validate SSH server identities, the library could bypass this security check by accepting connections to servers that weren't in the specified file, if they were previously trusted in the system-wide known_hosts database. This undermines the intended host verification security control and could enable man-in-the-middle attacks.

Technologies: Haxx Curl. Vendors: Haxx.

Quick answers

Is CVE-2025-15079 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-15079 being exploited in the wild.
How severe is CVE-2025-15079?: Medium severity, with a CVSS score of 5.3, published 8 January 2026.
Which products and versions are affected?: curl curl 7.58.0 through 8.17.0 (except 8.14.2+, 8.16.1+).
Is there a fix for CVE-2025-15079?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-15079 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-15079?: Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2025-15079 is a host validation bypass affecting libcurl versions 7.58.0 through 8.17.0 when built with the libssh backend (not libssh2). When users set a custom known_hosts file for SFTP/SCP transfers to restrict which hosts are trusted, libcurl's use of the libssh library unexpectedly falls back to the system-wide global known_hosts file as a fallback if a host is not found in the specified file. This is a CWE-297 improper certificate/host validation issue. The attack vector is network-based; no user interaction or authentication is required—an attacker performing a man-in-the-middle attack against SSH traffic could connect if their server was previously accepted globally. The fix forces libcurl to use only the specified known_hosts file by setting both libssh's known_hosts paths identically. Patches are available in curl versions 8.14.2+, 8.16.1+, and 8.18.0+.

Affected products

curl curl 7.58.0 through 8.17.0 (except 8.14.2+, 8.16.1+)

Timeline

2026-01-07: disclosed: curl 8.18.0 released with fix
2025-12-24: other: Vulnerability reported to curl project
2025-12-30: other: Distros@openwall contacted for coordinated disclosure

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.