CVE-2026-87865
Published: October 17, 2026Last modified: October 21, 2026
Description
When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | curl | Not affected (8.1.0-r2) |
| 25 LTS | curl | Not affected (8.14.0-r1) | |
| Stream | curl | Not affected (8.1.2-r0) | |
| Hardened Containers | Stream | curl | Not affected (8.1.2-r0) |