CURL-CVE-2026-86410
- Source
- https://curl.se/docs/CVE-2026-86410.html
- Import Source
- https://curl.se/docs/CURL-CVE-2026-86410.json
- JSON Data
- https://api.osv.dev/v1/vulns/CURL-CVE-2026-86410
- Aliases
-
- CVE-2026-86410
- Published
- 2026-10-14T08:00:00Z
- Modified
- 2026-10-14T07:00:03Z
- Summary
- redirect to SFTP or SCP bypasses host verification
- Details
-
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect.
- Database specific
{ "CWE": { "desc": "Improper Validation of Certificate with Host Mismatch", "id": "CWE-297" }, "URL": "https://curl.se/docs/CVE-2026-86410.json", "affects": "tool", "issue": "https://hackerone.com/reports/3973176", "last_affected": "8.22.0", "package": "curl", "severity": "Low", "www": "https://curl.se/docs/CVE-2026-86410.html" }- Credits
-
-
- Stanislav Fort (Aisle Research) - FINDER
-
- Daniel Stenberg - REMEDIATION_DEVELOPER
-
Affected packages
Git /
Affected versions
7.*
7.81.0
7.82.0
7.83.0
7.83.1
7.84.0
7.85.0
7.86.0
7.87.0
7.88.0
7.88.1
8.*
8.0.0
8.0.1
8.1.0
8.1.1
8.1.2
8.10.0
8.10.1
8.11.0
8.11.1
8.12.0
8.12.1
8.13.0
8.14.0
8.14.1
8.15.0
8.16.0
8.17.0
8.18.0
8.19.0
8.2.0
8.2.1
8.20.0
8.21.0
8.22.0
8.3.0
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1