CVE-2026-87865 curl CVE debrief

Who should care

Defenders responsible for systems and applications using libcurl with libssh2 should assess their exposure to this vulnerability, particularly those managing SSH connections and known_hosts files.

Why it matters

CVE-2026-87865 is a vulnerability in libcurl that can cause host key validation issues when used with libssh2 and hashed known_hosts files. Defenders should prioritize verifying exposure and implementing mitigations.

• Defenders need to verify the presence of libcurl and libssh2 in their environments and review configurations for CURLOPT_SSH_KEYFUNCTION callbacks.
• Affected versions require assessment and potential updates to mitigate the mismatch issue.
• Defensive priority is set to verifying exposure and implementing compensating controls.

Technical summary

The libcurl library, when used with libssh2 and a hashed known_hosts file, can cause host key validation to report a key mismatch as a missing key to the CURLOPT_SSH_KEYFUNCTION callback due to an unrelated initial entry. This issue arises from the way libcurl handles the known_hosts file, potentially leading to incorrect validation results. Affected product context indicates that systems and applications using libcurl with libssh2 are vulnerable. The defensive impact is significant, as defenders need to verify exposure and implement mitigations to prevent potential security breaches.

Defensive priority

Defenders should prioritize verifying the presence of libcurl and libssh2 in their environments, reviewing their configurations for CURLOPT_SSH_KEYFUNCTION callbacks, and assessing potential exposure to affected versions.

Recommended defensive actions

• Verify the presence of libcurl and libssh2 in your environment.
• Review configurations for CURLOPT_SSH_KEYFUNCTION callbacks.
• Assess potential exposure to affected versions.
• Implement vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide limited information about the vulnerability, primarily focusing on the mismatch issue in libcurl's handling of libssh2 with hashed known_hosts files. Evidence is limited to public CVE Program records and supplemental source references. Defenders should verify the presence of libcurl and libssh2 in their environments, review configurations for CURLOPT_SSH_KEYFUNCTION callbacks, and assess potential exposure to affected versions. The CVE record does not provide explicit details on affected products

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.