Description
curl's code for managing SSH connections when SFTP was done using the wolfSSH
powered backend was flawed and missed host verification mechanisms.
This prevents curl from detecting MITM attackers and more.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| curl | curl | 7.69.0 – < 8.14.2, 8.15.0 – < 8.16.1, 8.16.0, 8.15.0, 8.14.1, 8.14.0, 8.13.0, 8.12.1, 8.12.0, 8.11.1, 8.11.0, 8.10.1, 8.10.0, 8.9.1, 8.9.0, 8.8.0, 8.7.1, 8.7.0, 8.6.0, 8.5.0, 8.4.0, 8.3.0, 8.2.1, 8.2.0, 8.1.2, 8.1.1, 8.1.0, 8.0.1, 8.0.0, 7.88.1, 7.88.0, 7.87.0, 7.86.0, 7.85.0, 7.84.0, 7.83.1, 7.83.… | 8.14.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | curl | 8.17.0~rc2-1 | — |
| Debian 13 | curl | No fix yet | — |
| Debian 12 | curl | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | curl +3 | 8.19.0-3.hum1 | RHSA-2026:6893 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | curl | 8.17.0-1.1 | openSUSE-SU-2025:15757-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | curl | 8.17.0-r0 | — |
| Alpine v3.23 | curl | 8.17.0-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | curl +4 | 8.15.0-4.amzn2023.0.1 | ALAS2023-2025-1351 |
| Amazon Linux 2 | curl +2 | 8.3.0-1.amzn2.0.12 | ALAS2-2026-3173 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cmake | 3.30.3-12 | — |
| Azure Linux 2 (CBL-Mariner) | cmake | No fix yet | — |
Advisories 9
- WID-SEC-2026-2189 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- RHSA-2026:6893 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- ICSA-26-188-05 Siemens SINEC OS CISA ICS & IT advisories · Jul 7, 2026
- SSA-253495 SSA-253495: Multiple Vulnerabilities in SINEC OS before V4.0 Siemens ProductCERT · Jun 2, 2026
- WID-SEC-2025-2563 Microsoft Azure Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 11, 2026
- WID-SEC-2025-2489 cURL: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Feb 18, 2026
- ALAS2-2026-3173 Moderate: curl security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 18, 2026
- openSUSE-SU-2025:15757-1 curl-8.17.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2023-2025-1351 Moderate: curl security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jan 7, 2026