CVE-2025-15079 — libssh global known_hosts override
When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specifi…
Published: 2026-01-08 · CVSS: 5.3 · CVSS 3.1
When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7