Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 1 vendor · 1 advisory

CVE-2026-12064

CVE-2026-12064: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Red Hat

1 advisory
  • Advisory severityHigh7.5

    High [CVE-2026-12064] SSH host verification bypass when using schemeless URLs with SFTP/SCP

    CVE-2026-12064Source published Source updated

    When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error. A flaw was found in curl. This could enable an attacker to intercept or manipulate data through a…

    Affected products in this advisory
    • Red Hat Enterprise Linux 10
    • Red Hat Hardened Images
    • Red Hat package: curl
    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    • curl-0:8.12.1-4.el10_2.3
    • curl-main-8.21.0-0.1.hum1
    • rust-main-1.96.1-1.hum1
    • RHSA-2026:55450

    2 more entries in the full advisory.

    Mitigation guidance
    • To mitigate this issue, avoid using the `--proto-default sftp` or `--proto-default scp` options with schemeless URLs when invoking the `curl` command. Instead, explicitly specify the protocol in the URL (e.g., `sftp://host/path` or `scp://host/path`).
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Monitor future Red Hat CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features