CVE-2026-12064: proto-default skips SSH verification
Last updated 10 July 2026
Other sources
When a user invokes curl using a schemeless URL combined with --proto-default sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPTSSHHOSTPUBLICKEYSHA256 and CURLOPTSSHKNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPTDEFAULTPROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.21.0-2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.11.1-10
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12064?
CVE-2026-12064 has a severity rating of high, with a CVSS score of 7.5.
What are the potential risks associated with CVE-2026-12064?
The primary risk of CVE-2026-12064 involves bypassing critical SSH security options, potentially exposing users to security vulnerabilities.
How can I mitigate CVE-2026-12064?
To mitigate CVE-2026-12064, avoid using schemeless URLs with the --proto-default option for sftp or scp until a patch is released.
Is CVE-2026-12064 exploitable remotely?
Yes, CVE-2026-12064 can be exploited remotely due to the nature of how curl handles schemeless URLs.
Which software is affected by CVE-2026-12064?
CVE-2026-12064 affects the curl command-line tool and its underlying libcurl library.