4.3
Medium
CVE-2025-10966 curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host…
Description
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| curl | 8.16.0 | No fix stated |
| curl | 8.15.0 | No fix stated |
| curl 8.14 | 8.14.0 → 8.14.1 | No fix stated |
| curl | 8.13.0 | No fix stated |
| curl 8.12 | 8.12.0 → 8.12.1 | No fix stated |
| curl 8.11 | 8.11.0 → 8.11.1 | No fix stated |
| curl 8.10 | 8.10.0 → 8.10.1 | No fix stated |
| curl 8.9 | 8.9.0 → 8.9.1 | No fix stated |
| curl | 8.8.0 | No fix stated |
Show the 29 other branches Hide the 29 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| curl 8.7 | 8.7.0 → 8.7.1 | No fix stated |
| curl | 8.6.0 | No fix stated |
| curl | 8.5.0 | No fix stated |
| curl | 8.4.0 | No fix stated |
| curl | 8.3.0 | No fix stated |
| curl 8.2 | 8.2.0 → 8.2.1 | No fix stated |
| curl 8.1 | 8.1.0 → 8.1.2 | No fix stated |
| curl 8.0 | 8.0.0 → 8.0.1 | No fix stated |
| curl 7.88 | 7.88.0 → 7.88.1 | No fix stated |
| curl | 7.87.0 | No fix stated |
| curl | 7.86.0 | No fix stated |
| curl | 7.85.0 | No fix stated |
| curl | 7.84.0 | No fix stated |
| curl 7.83 | 7.83.0 → 7.83.1 | No fix stated |
| curl | 7.82.0 | No fix stated |
| curl | 7.81.0 | No fix stated |
| curl | 7.80.0 | No fix stated |
| curl 7.79 | 7.79.0 → 7.79.1 | No fix stated |
| curl | 7.78.0 | No fix stated |
| curl | 7.77.0 | No fix stated |
| curl 7.76 | 7.76.0 → 7.76.1 | No fix stated |
| curl | 7.75.0 | No fix stated |
| curl | 7.74.0 | No fix stated |
| curl | 7.73.0 | No fix stated |
| curl | 7.72.0 | No fix stated |
| curl 7.71 | 7.71.0 → 7.71.1 | No fix stated |
| curl | 7.70.0 | No fix stated |
| curl 7.69 | 7.69.0 → 7.69.1 | No fix stated |
| RUGGEDCOM RST2428P 4.0 | earliest → < 4.0 | 4.0 |
References
- curl.se curl.se
- curl.se curl.se
- hackerone.com hackerone.com
Timeline
- Published
- Last modified
Other CVEs of curl
The 98 CVEs of curl →
CVE-2026-107929
When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes…
8.1
High
CVE-2026-107928
When curl is built with GnuTLS, a malicious WebSocket server can make curl
send memory past its send buffer
8.1
High
CVE-2026-94266
libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing…
7.5
High
CVE-2026-94265
When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might…
9.1
Critical