CVE-2026-87865 — knownhost callback mismatches key as missing
When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOP…
Published: 2026-10-20 · CVSS: Unscored
When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7