CVE-2026-12064Haxx Curl
NVDCVSS scored by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Vulnerability Summary
When a user invokes curl using a schemeless URL combined with
`--proto-default` sftp (or scp), a disconnect occurs between the tool layer
and libcurl. The tool layer incorrectly infers the URL scheme, which
erroneously bypasses the initialization of critical SSH security options like
CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the
libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes
the connection via SFTP/SCP as specified. Because the tool layer skipped the
security configuration, these SSH host verification options are silently
omitted, causing curl to connect to an unverified SSH remote host without
throwing an error.
`--proto-default` sftp (or scp), a disconnect occurs between the tool layer
and libcurl. The tool layer incorrectly infers the URL scheme, which
erroneously bypasses the initialization of critical SSH security options like
CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the
libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes
the connection via SFTP/SCP as specified. Because the tool layer skipped the
security configuration, these SSH host verification options are silently
omitted, causing curl to connect to an unverified SSH remote host without
throwing an error.
CVSS v3.1 Base Metrics — Score 7.5 (HIGH)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NAttack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityNone
IntegrityHigh
AvailabilityNone
Affected & Patched Versions
- Haxx Curl >= 7.81.0 and < 8.21.0
- Haxx Curl 8.21.0
What to do
Prioritize this fix. Exploit code is public, so attacks can follow quickly.
- Check whether you run Haxx Curl and which version.
- Update to a patched version listed above, then confirm the new version.
- Review logs and exposed services for signs of earlier compromise.
Timeline
- Jul 3, 2026Published
- Jul 7, 2026Record last modified
Score, severity and exploitation changes are tracked from the day Watchtower started logging them.
Get notified about new Haxx Curl CVEsYou are reading CVE-2026-12064. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alertsRelated Coverage
External References
Data last checked: Nov 15, 2026 00:23 UTC