CVE-2026-9547: Haxx Curl Information Disclosure Flaw

CVE-2026-9547 Overview

CVE-2026-9547 is a certificate validation flaw in libcurl affecting SSH-based transfers over SCP:// and SFTP://. The vulnerability occurs when applications use the CURLOPT_SSH_KEYFUNCTION callback to verify SSH host keys. When a server presents a host key type that differs from the type already recorded in the known_hosts file, libcurl fails to reject the mismatch. Instead, the callback mechanism allows the connection to proceed silently, exposing users to man-in-the-middle attacks. The vulnerability affects the haxx:curl component and is tracked under [CWE-Other] per NVD classification.

Critical Impact
An attacker positioned on the network path can present a different SSH host key type than the one stored in known_hosts and intercept authenticated SCP or SFTP sessions without triggering a warning.

Affected Products

Haxx cURL (libcurl) — applications using CURLOPT_SSH_KEYFUNCTION
SCP:// transfer clients built on libcurl
SFTP:// transfer clients built on libcurl

Discovery Timeline

2026-07-03 - CVE-2026-9547 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-9547

Vulnerability Analysis

The flaw resides in how libcurl handles SSH host key verification when the calling application registers a CURLOPT_SSH_KEYFUNCTION callback. libcurl matches a server's presented host key against entries in the known_hosts file. When the server offers a host key of a different algorithm type than what is stored for that host, libcurl should treat the mismatch as untrusted and reject the connection. Instead, the callback path fails to enforce the type restriction, and the transfer proceeds. This behavior undermines a core trust boundary of the SSH protocol and enables an active network attacker to substitute their own key pair, decrypt or modify traffic, and harvest credentials or files transferred over SCP or SFTP.

Root Cause

The root cause is inadequate enforcement inside libcurl's SSH known-hosts callback handler. Rather than treating a host key type mismatch as a distinct trust failure, the code path returns a success indication to the transfer engine. The known-hosts record for a host binds a specific key type to a fingerprint, and a change in key type should invalidate the entry rather than open a new one implicitly.

Attack Vector

Exploitation requires network positioning between the libcurl client and the legitimate SSH server. The attacker intercepts the connection and offers a host key of a different algorithm than the one recorded in the client's known_hosts. Because libcurl does not reject the mismatch, the client completes the handshake with the attacker's key, allowing full man-in-the-middle interception of the SFTP or SCP session. The attack complexity is elevated because the attacker must control the network path and previously know the target host had a stored key of a specific type.

No verified public exploit code is available. See the cURL CVE-2026-9547 Advisory for authoritative technical detail.

Detection Methods for CVE-2026-9547

Indicators of Compromise

Unexpected changes to SSH host key algorithm entries in known_hosts files on hosts running libcurl-based clients.
SCP or SFTP sessions completing successfully to hosts where the server-side host key algorithm has recently changed without administrative action.
Network captures showing SSH KEXINIT exchanges advertising a host key type that differs from historical baselines for a given destination.

Detection Strategies

Inventory applications linking against libcurl and identify those registering CURLOPT_SSH_KEYFUNCTION for SCP or SFTP transfers.
Compare known_hosts snapshots across endpoints to detect silent additions of new host key types for previously trusted hosts.
Correlate outbound port 22 traffic with process telemetry to identify libcurl-based transfers to unexpected destinations.

Monitoring Recommendations

Log SSH host key fingerprints observed by libcurl clients and alert when a stored host presents a new key algorithm.
Monitor package inventories for vulnerable libcurl versions across Linux, macOS, and Windows fleets.
Track HackerOne report #3751712 and vendor advisories for patched release information.

How to Mitigate CVE-2026-9547

Immediate Actions Required

Upgrade libcurl to the fixed version referenced in the cURL CVE-2026-9547 Advisory as soon as it is available in your distribution.
Audit application code that sets CURLOPT_SSH_KEYFUNCTION and add explicit host key type validation inside the callback until the patched library is deployed.
Rebuild and redistribute statically linked applications that embed vulnerable libcurl versions.

Patch Information

The cURL project publishes patched releases and structured advisory data at the cURL CVE-2026-9547 Advisory and cURL CVE-2026-9547 JSON Data. Apply the vendor-supplied update matching your platform and rebuild dependent binaries.

Workarounds

Implement custom host key verification inside the CURLOPT_SSH_KEYFUNCTION callback that explicitly compares both the key type and fingerprint against the expected known_hosts entry and returns a rejection on any mismatch.
Where feasible, replace libcurl-based SCP or SFTP transfers with the OpenSSH sftp or scp clients, which enforce host key type matching.
Restrict SCP and SFTP destinations to hosts reachable only over trusted network segments until patched libcurl is deployed.

bash

# Verify installed libcurl version and locate applications linking against it
curl --version
ldconfig -p | grep libcurl
# On Debian/Ubuntu, upgrade once the fixed package is published
sudo apt update && sudo apt install --only-upgrade libcurl4 curl