CVE-2026-86410

Name of the Vulnerable Software and Affected Versions curl versions prior to 8.23.0-1.1

Description A logic flaw in the curl command line tool prevents SSH host verification options from being applied when a connection is established via a redirect. Specifically, if the initial request is HTTPS and the server returns a Location: sftp://example.com redirect while using --location and --proto-redir +sftp, the subsequent SFTP connection ignores the user's requested verification methods. This affects the application of the --knownhosts, --hostpubsha256, and --hostpubmd5 options.

Recommendations Update to version 8.23.0-1.1.