PT-2026-51744 · Git · Curl

Publicado 2026-06-24 · Atualizado 2026-06-24 · CVE-2026-12064

OSV

When a user invokes curl using a schemeless URL combined with --proto-default sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT SSH HOST PUBLIC KEY SHA256 and CURLOPT SSH KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT DEFAULT PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.

Enumeração de Fraquezas

CWE-297

Identificadores relacionados

CVE-2026-12064

Produtos afetados

Curl

Referências · 2

• https://hackerone.com/reports/3797526 · Nota
• https://osv.dev/vulnerability/CURL-CVE-2026-12064 · Aviso do Fabricante