CVE-2026-12064

Name of the Vulnerable Software and Affected Versions curl (affected versions not specified)

Description A disconnect between the tool layer and libcurl occurs when a user invokes curl with a schemeless URL and the --proto-default option set to sftp or scp. The tool layer incorrectly infers the URL scheme, which bypasses the initialization of critical SSH security options, specifically CURLOPT SSH HOST PUBLIC KEY SHA256 and CURLOPT SSH KNOWNHOSTS. While the libcurl runtime still establishes the connection via SFTP or SCP, the omission of these host verification options allows curl to connect to an unverified SSH remote host without triggering an error.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.