Skip to content
OpenAdvisories
High ALAS2-2026-4099 1 CVE

Important: curl security update (Amazon Linux 2)

Published Nov 12, 2026 · Updated Nov 12, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-87865: When libcurl uses libssh2 with a hashed known_hosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPT_SSH_KEYFUNCTION callback.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 curl 0:8.3.0-1.amzn2.0.14
Amazon Linux · 2 curl-debuginfo 0:8.3.0-1.amzn2.0.14
Amazon Linux · 2 libcurl 0:8.3.0-1.amzn2.0.14
Amazon Linux · 2 libcurl-devel 0:8.3.0-1.amzn2.0.14

Vulnerabilities 1

  • High 7.4
    CVE-2026-87865

    knownhost callback mismatches key as missing

    When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-87865.html