CVE-2025-15079

ADVISORY - nist

Summary

When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file.

EPSS Score⁠: 0.00031 (0.086)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-297⁠

Improper Validation of Certificate with Host Mismatch

Impacted images

Advisories

Sign in to Docker Scout

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.