CVE-2026-9547: 
cURL vulnerability analysis and mitigation

CVE-2026-9547 is an SSH improper host validation vulnerability in libcurl that allows a man-in-the-middle attacker to silently intercept SCP or SFTP connections. When a libcurl-based application uses the CURLOPT_SSH_KEYFUNCTION callback and a server presents a host key type that differs from the type recorded in the known_hosts file, libcurl fails to reject the mismatch and proceeds with the connection without warning. The flaw affects curl versions 7.69.0 through 8.20.0 (inclusive) and is only present when curl is built with the libssh backend — not libssh2 — and does not affect the curl command-line tool itself. It was reported on May 20, 2026 by Joshua Rogers of Aisle Research and publicly disclosed on June 24, 2026 alongside the release of curl 8.21.0. The CVSS v3.1 base score is 7.4 (High) (curl Advisory, GitHub Advisory).

The root cause is classified as CWE-297 (Improper Validation of Certificate with Host Mismatch) by the curl project, and CWE-347 (Improper Verification of Cryptographic Signature) by NVD. The vulnerability was introduced in commit 507cf6a13db0375eadd4655b4c64710db29e9cf2 (curl 7.69.0) and resides in the CURLOPT_SSH_KEYFUNCTION callback mechanism used during SSH host key verification for SCP/SFTP transfers. When the server presents a host key of a different type (e.g., ECDSA vs. RSA) than what is stored in known_hosts, the callback logic incorrectly classifies the result as a match rather than a mismatch, allowing the connection to proceed silently. Exploitation requires a network-positioned attacker capable of intercepting the SSH handshake (high attack complexity), but no privileges or user interaction are needed. A standalone C proof-of-concept (poc.c) demonstrating the misclassified host key match result is publicly available via HackerOne (curl Advisory, HackerOne PoC).

Successful exploitation enables an unauthenticated, network-positioned attacker to perform a man-in-the-middle (MitM) attack against SCP or SFTP file transfers conducted by libcurl-based applications. The attacker can intercept and read transferred data (high confidentiality impact) and potentially modify files in transit (high integrity impact); availability is not affected. Any application or service using libcurl with the libssh backend and the CURLOPT_SSH_KEYFUNCTION callback for SCP/SFTP transfers is at risk, which could include automated backup systems, deployment pipelines, or file synchronization tools that rely on SSH-based transfers (curl Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify applications using libcurl built with the libssh backend that perform SCP (scp://) or SFTP (sftp://) transfers and are configured with the CURLOPT_SSH_KEYFUNCTION callback. Check the target environment's libcurl version (must be 7.69.0–8.20.0).
2. Network Positioning: Gain a man-in-the-middle position on the network path between the libcurl client and the target SSH server (e.g., via ARP spoofing, DNS poisoning, or rogue Wi-Fi access point).
3. Present Mismatched Host Key: When the libcurl client initiates an SCP/SFTP connection, intercept the SSH handshake and present a host key of a different type than the one recorded for that host in the client's known_hosts file (e.g., if known_hosts has an RSA key, present an ECDSA key).
4. Bypass Verification: Due to the flawed CURLOPT_SSH_KEYFUNCTION callback logic, libcurl incorrectly accepts the mismatched key type as valid and proceeds with the connection without alerting the application or user.
5. Intercept/Modify Traffic: With the MitM position established and the connection accepted, decrypt, read, or modify the SCP/SFTP file transfer data in transit before forwarding it to the legitimate server (curl Advisory, HackerOne PoC).

• Network: Unexpected SSH handshakes where the server's presented host key type differs from the type stored in known_hosts (e.g., RSA in known_hosts but ECDSA presented); anomalous intermediate hosts appearing in network traffic between SCP/SFTP client and server; unexpected TCP connections on port 22 from unfamiliar IP addresses.
• Logs: Application logs showing successful SCP/SFTP connections to hosts where the key type in known_hosts does not match the server's advertised key type; libcurl debug output (if enabled via CURLOPT_VERBOSE) showing host key type mismatches that did not result in connection termination.
• File System: Unexpected modifications to files received via SCP/SFTP transfers; checksums of transferred files not matching expected values; known_hosts file modifications adding new key types for existing hosts.
• Process Behavior: libcurl-based processes successfully completing SCP/SFTP transfers to hosts where the SSH host key fingerprint has changed or the key type differs from what was previously recorded (curl Advisory).

The primary remediation is to upgrade curl and libcurl to version 8.21.0 or later, which contains the fix in commit 0b8dbbc63c98777e4584cb9fbd71df3464008ad1. If upgrading immediately is not possible, two workarounds are available: (1) rebuild libcurl using the libssh2 backend instead of libssh, as the vulnerability does not exist in libssh2; or (2) apply the upstream patch to the existing version and rebuild. Applications that do not use the CURLOPT_SSH_KEYFUNCTION callback are not affected by this specific flaw. Red Hat and other Linux distributions are tracking this issue for their respective package updates (curl Advisory, Red Hat Bugzilla).

The curl 8.21.0 release was notable for patching 18 CVEs simultaneously — described by multiple outlets as a record-breaking security release — with CVE-2026-9547 being one of several vulnerabilities discovered by Joshua Rogers of Aisle Research. Security media including SecurityWeek, SecurityAffairs, and CyberSecurityNews covered the release, with some highlighting a separate 25-year-old vulnerability patched in the same release as the headline story. The curl project maintainer Daniel Stenberg published a blog post announcing the 8.21.0 release. Community discussion noted that the flaw is limited in scope (libssh backend only, requires MitM positioning) and was rated "Low" severity by the curl project itself despite the NVD's "High" CVSS score (Daniel Haxx Blog, Aisle Research Blog, SecurityWeek).