knownhost callback mismatches key as missing
Impact
When libcurl uses libssh2 with a hashed known_hosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPT_SSH_KEYFUNCTION callback.
Source excerpt · curlAffected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
curl · curl
curl
58 ranges
curl · curl
curl
Compare with this publisher’s ranges. This does not inspect your installation.
affected
8.22.0 → through 8.22.0
semver versions
8.21.0 → through 8.21.0
semver versions
8.20.0 → through 8.20.0
semver versions
8.19.0 → through 8.19.0
semver versions
8.18.0 → through 8.18.0
semver versions
8.17.0 → through 8.17.0
semver versions
8.16.0 → through 8.16.0
semver versions
8.15.0 → through 8.15.0
semver versions
8.14.1 → through 8.14.1
semver versions
8.14.0 → through 8.14.0
semver versions
8.13.0 → through 8.13.0
semver versions
8.12.1 → through 8.12.1
semver versions
8.12.0 → through 8.12.0
semver versions
8.11.1 → through 8.11.1
semver versions
8.11.0 → through 8.11.0
semver versions
8.10.1 → through 8.10.1
semver versions
8.10.0 → through 8.10.0
semver versions
8.9.1 → through 8.9.1
semver versions
8.9.0 → through 8.9.0
semver versions
8.8.0 → through 8.8.0
semver versions
8.7.1 → through 8.7.1
semver versions
8.7.0 → through 8.7.0
semver versions
8.6.0 → through 8.6.0
semver versions
8.5.0 → through 8.5.0
semver versions
8.4.0 → through 8.4.0
semver versions
8.3.0 → through 8.3.0
semver versions
8.2.1 → through 8.2.1
semver versions
8.2.0 → through 8.2.0
semver versions
8.1.2 → through 8.1.2
semver versions
8.1.1 → through 8.1.1
semver versions
8.1.0 → through 8.1.0
semver versions
8.0.1 → through 8.0.1
semver versions
8.0.0 → through 8.0.0
semver versions
7.88.1 → through 7.88.1
semver versions
7.88.0 → through 7.88.0
semver versions
7.87.0 → through 7.87.0
semver versions
7.86.0 → through 7.86.0
semver versions
7.85.0 → through 7.85.0
semver versions
7.84.0 → through 7.84.0
semver versions
7.83.1 → through 7.83.1
semver versions
7.83.0 → through 7.83.0
semver versions
7.82.0 → through 7.82.0
semver versions
7.81.0 → through 7.81.0
semver versions
7.80.0 → through 7.80.0
semver versions
7.79.1 → through 7.79.1
semver versions
7.79.0 → through 7.79.0
semver versions
7.78.0 → through 7.78.0
semver versions
7.77.0 → through 7.77.0
semver versions
7.76.1 → through 7.76.1
semver versions
7.76.0 → through 7.76.0
semver versions
7.75.0 → through 7.75.0
semver versions
7.74.0 → through 7.74.0
semver versions
7.73.0 → through 7.73.0
semver versions
7.72.0 → through 7.72.0
semver versions
7.71.1 → through 7.71.1
semver versions
7.71.0 → through 7.71.0
semver versions
7.70.0 → through 7.70.0
semver versions
7.69.1 → through 7.69.1
semver versions
Other versions: unaffected
Original source description
When libcurl uses libssh2 with a hashed known_hosts file, an unrelated
initial entry can cause host key validation to report a key mismatch as a
missing key to the CURLOPT_SSH_KEYFUNCTION callback.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-87865View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.