Unrated

curl proto-default skips SSH verification

IdentifiersCVE-2026-12064CWE-297

CVE-2026-12064 is a low-severity vulnerability in the curl command-line tool, not in libcurl generally. It is triggered when curl is invoked with a schemeless URL together with --proto-default set to sftp or scp. In this code path, the curl tool layer incorrectly infers the URL scheme and fails to initialize SSH verification-related options before handing off to libcurl. Specifically, the advisory states that critical SSH security options such as CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS are silently omitted. libcurl still honors CURLOPT_DEFAULT_PROTOCOL and proceeds to establish the connection using SFTP or SCP, creating a mismatch between the tool layer's assumptions and the actual protocol used. As a result, curl may connect to an SSH server without performing the expected host verification and without reporting an error. The issue affects curl versions 7.81.0 through 8.20.0 inclusive and was fixed in 8.21.0.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation causes curl to connect to an unverified SSH remote host over SFTP or SCP. This weakens SSH host authenticity checks and exposes users to man-in-the-middle or impersonation scenarios in which a malicious or spoofed SSH endpoint can be accepted without error. Based on the provided content, the impact is limited to the curl CLI invocation pattern described and is rated Low severity by the project.

Mitigation

If you can’t patch tonight, do this now.

Avoid using --proto-default with scp or sftp when supplying schemeless URLs until the fixed version is deployed. More generally, use explicit URL schemes for SSH-based transfers so the tool layer initializes the correct SSH verification settings.

Remediation

Patch, then assume compromise.

Upgrade curl to version 8.21.0 or later. If upgrading is not possible, apply the vendor patch associated with the fix and rebuild curl. The content indicates the issue was fixed by commit ab3bb8cd8be8f9d4acb97da041.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

cyber security newsNews

Jun 25, 2026

25-Year-Old Vulnerability in curl Used by 30 Billion Devices Finally Patched

A curl/libcurl SSH verification vulnerability where verification may be skipped due to protocol-default behavior.

daniel haxx seNews

Jun 24, 2026

curl 8.21.0 | daniel.haxx.se

A low-severity curl/libcurl vulnerability where default protocol handling can skip SSH verification.

curlNews

Jun 24, 2026

curl - proto-default skips SSH verification - CVE-2026-12064

A low-severity curl command line tool vulnerability where using a schemeless URL with --proto-default set to sftp or scp can bypass SSH host verification options, causing connections to unverified SSH hosts.

curlNews

Jun 24, 2026

curl: [SECURITY ADVISORIES] for curl 8.21.0

A curl vulnerability where default protocol handling can skip SSH verification.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-12064

NVD

nvd.nist.gov/vuln/detail/CVE-2026-12064

MITRE CWE · CWE-297

cwe.mitre.org