CVE-2026-12064 proto-default skips SSH verification
Attackers can bypass SSH host verification when curl uses schemeless URLs with specific protocol defaults, allowing connections to unverified hosts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-12064?
CVE-2026-12064 is a high-severity vulnerability in Haxx Curl, published on 3 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.
Which versions are affected by CVE-2026-12064?
It affects 1 product.
Products include Haxx Curl.
How do I fix CVE-2026-12064?
Apply the vendor's patch.
Is CVE-2026-12064 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-12064 exists.
Other vulnerabilities in Haxx Curl
Sources
Also known as ALPINE-CVE-2026-12064, AZL-91812, BELL-CVE-2026-12064, CURL-CVE-2026-12064, DEBIAN-CVE-2026-12064, ECHO-2ea7-d2c8-d549 and 12 more.