CVE detail
CVE-2026-9547
When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 19.5 · diversity 20.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 4
- within the 30d window
- Peak daily
- 3
- highest bucket
Evidence
Source links by recency
6 source links · newest first
- CVE-2026-9547 SSH improper host validationMicrosoft MSRC
Information published.
vendormsrc.microsoft.comJul 9, 2026, 8:47 AM - https://hackerone.com/reports/3751712hackerone.com
No excerpt available.
Exploithackerone.comJul 3, 2026, 7:16 AM No excerpt available.
Vendor Advisorycurl.seJul 3, 2026, 7:16 AMNo excerpt available.
Vendor Advisorycurl.seJul 3, 2026, 7:16 AM- Curl Fixes a 25-Year-Old Bug in Its Largest CVE Release YetSecurity Affairs
Curl fixed 18 vulnerabilities, including a 25-year-old bug, with issues spanning auth bypass, memory safety, and host validation in libcurl. Curl maintainers addressed eighteen vulnerabilities with a single update, and one of them goes back 25 years. That’s not a typo, it really sat there since the early 2000s. curl is a widely used open-source […]
newssecurityaffairs.comJun 25, 2026, 7:20 PM - 25-Year-Old Vulnerability Patched in CurlSecurityWeek
The latest version of the open source data transfer tool resolves 18 medium and low-severity vulnerabilities.
newswww.securityweek.comJun 25, 2026, 9:25 AM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-9546CVSS 7.5 · High
A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppres…
3 mentions - CVE-2026-9545CVSS 7.5 · High
In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's…
4 mentions - CVE-2026-9080CVSS 7.3 · High
Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangl…
- CVE-2026-9079CVSS 9.8 · Critical
libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers…
- CVE-2026-8932CVSS 7.5 · High
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used co…
7 mentions - CVE-2026-8927CVSS 9.1 · Critical
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests.…