CVE-2025-15079: 
cURL vulnerability analysis and mitigation

CVE-2025-15079 is a host verification bypass vulnerability in libcurl, dubbed "libssh global known_hosts override," that allows libcurl to mistakenly accept SSH connections to hosts not present in a user-specified known_hosts file if those hosts appear in the libssh global known_hosts file. It affects curl versions 7.58.0 through 8.17.0 (inclusive) and was introduced via commit c92d2e14cfb0db662f958effd2ac86f99. The vulnerability was reported on December 24, 2025, and publicly disclosed alongside the release of curl 8.18.0 on January 7, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium), though the curl project rates its severity as Low (curl Advisory, Openwall OSS-Sec).

The root cause is classified as CWE-297 (Improper Validation of Certificate with Host Mismatch). The flaw exists exclusively when libcurl is built against the libssh backend (not libssh2); libssh's API silently falls back to a globally configured known_hosts file (whose path is set at build time) when a host is not found in the application-specified file. libcurl did not account for this fallback behavior, meaning a host absent from the user-configured file could still be accepted if it appeared in the system-wide libssh known_hosts file. The fix, applied in commit adca486c125d9a6d9565b9607a19dce803, makes libcurl explicitly set both the application-level and global known_hosts paths to the same user-specified file, eliminating the unintended fallback (curl Advisory, Openwall OSS-Sec).

Successful exploitation enables a man-in-the-middle (MITM) attack against SCP or SFTP transfers performed by libcurl. An attacker who can position themselves between the client and a host that is recognized in the system's global libssh known_hosts file (but not in the application's specified file) could intercept and read sensitive data in transit, resulting in a high confidentiality impact. Integrity and availability are not directly affected. The vulnerability is particularly relevant to automated scripts and applications that rely on libcurl for SSH-based file transfers and assume strict host verification (curl Advisory, Feedly).

1. Identify target: Locate systems running curl 7.58.0–8.17.0 built with the libssh backend that perform SCP or SFTP transfers with a user-specified known_hosts file.
2. Reconnaissance: Determine a hostname or IP that is present in the target system's global libssh known_hosts file (typically /etc/ssh/ssh_known_hosts or the path compiled into libssh) but intentionally absent from the application's specified known_hosts file.
3. Network positioning: Achieve a MITM position on the network path between the curl client and the intended SSH server (e.g., via ARP spoofing, DNS poisoning, or BGP hijacking on the relevant network segment).
4. Impersonate the server: Present an SSH host key matching the entry in the global libssh known_hosts file for the target hostname.
5. Intercept transfer: When the victim initiates an SCP or SFTP transfer via libcurl, the library accepts the connection due to the fallback to the global known_hosts file, allowing the attacker to intercept and read the transferred data (curl Advisory, HackerOne).

• Network: Unexpected SSH connections to IP addresses not matching the intended SCP/SFTP server; anomalous ARP or DNS responses redirecting SSH traffic to unrecognized hosts.
• Logs: SSH client logs or curl verbose output (--verbose) showing successful host key verification for a host that should not be in the application's known_hosts file; connections to hosts whose keys match the system global known_hosts but not the application-specified file.
• File System: Unexpected modifications to /etc/ssh/ssh_known_hosts or the libssh global known_hosts file path (compiled into libssh); presence of unfamiliar host keys in the global known_hosts file.
• Process: curl or application processes initiating SCP/SFTP transfers to unexpected remote endpoints; network traffic analysis showing SSH handshakes with hosts not in the intended server list (curl Advisory).

The primary fix is to upgrade curl to version 8.18.0 or later, which sets both the application-level and global libssh known_hosts paths to the same user-specified file, eliminating the fallback. As interim workarounds, administrators can: (A) rebuild curl using the libssh2 backend instead of libssh, which is not affected by this flaw; or (B) avoid using SFTP or SCP via libcurl until patching is feasible. IBM has also released patches for affected MQ container images. Restricting SSH-based transfers to trusted, controlled network segments reduces MITM risk (curl Advisory, IBM Advisory).

The vulnerability was reported by security researcher Harry Sintonen and patched by curl maintainer Daniel Stenberg, who coordinated disclosure with the curl 8.18.0 release on January 7, 2026. The curl project rated the severity as "Low" despite the CVSS Medium score, reflecting the high attack complexity and limited real-world exploitability. The disclosure was covered by Linux distribution security channels (SUSE, Mageia, Ubuntu, Amazon Linux) and noted in the curl maintainer's blog post announcing the 8.18.0 release. Community discussion on platforms such as Mastodon and Bluesky was limited, consistent with the low severity rating (curl Blog, Openwall OSS-Sec).