CVE-2025-15079CWE-297

CVE-2025-15079

Medium · published January 8, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
45.2
In the wild
Unconfirmed
What it is

When doing SSH-based transfers using either SCP or SFTP, and setting the

known_hosts file, libcurl could still mistakenly accept connecting to hosts

*not present* in the specified file if they were added as recognized in the

libssh *global* known_hosts file.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00550 · 45.2th percentile
Weakness
CWE-297 · Improper Validation of Certificate with Host Mismatch
Published
2026-01-08T15:15Z
Affected products (1)
ProductVersionsFixed in
haxx/curl≥ 7.58.0, < 8.18.08.18.0
References (4)
https://curl.se/docs/CVE-2025-15079.html · 2499f714-1537-4658-8207-48ae4bb9eae9https://curl.se/docs/CVE-2025-15079.json · 2499f714-1537-4658-8207-48ae4bb9eae9https://hackerone.com/reports/3477116 · 2499f714-1537-4658-8207-48ae4bb9eae9http://www.openwall.com/lists/oss-security/2026/01/07/6 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 08 JAN 10:08Z
    libssh global known_hosts override
    cvelistv5