CVE-2026-9547
ADVISORY - debianSummary
When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the known_hosts file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.
- curl 8.21.0~rc2-1 (unimportant) https://curl.se/docs/CVE-2026-9547.html Debian builds with --without-libssh --with-libssh2. Introduced with: https://github.com/curl/curl/commit/507cf6a13db0375eadd4655b4c64710db29e9cf2 (curl-7_69_0) Fixed by: https://github.com/curl/curl/commit/0b8dbbc63c98777e4584cb9fbd71df3464008ad1 (rc-8_21_0-1, curl-8_21_0)
EPSS Score: 0.00325 (0.254)
Common Weakness Enumeration (CWE)
Alpine
CREATED
UPDATED
ADVISORY IDCVE-2026-9547
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
| Package | Type | OS Name | OS Version | Affected Ranges | Fix Versions |
|---|---|---|---|---|---|
| alpine/curl | apk | alpine | 3.23 | <=8.19.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.71.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.72.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.74.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.76.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.77.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.78.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.79.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.83.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.83.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.84.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.85.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.86.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.87.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.88.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.0.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.1.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.10.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.11.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.11.0-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.11.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.11.1-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.12.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.12.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.14.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.14.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.14.1-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.3.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.4.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.5.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.6.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.7.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.9.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.9.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.71.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.72.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.74.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.76.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.77.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.78.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.79.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.83.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.83.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.84.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.85.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.86.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.87.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.88.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.0.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.1.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.10.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.11.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.11.0-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.11.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.11.1-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.12.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.12.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.12.1-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.14.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.14.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.14.1-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.3.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.4.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.5.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.6.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.7.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.9.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.9.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.71.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.72.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.74.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.76.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.77.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.78.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.79.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.83.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.83.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.84.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.85.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.86.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.87.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.88.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.0.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.1.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.10.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.11.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.11.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.12.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.1-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.1-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.1-r3 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.3.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.4.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.5.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.6.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.7.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.9.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.9.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.23 | <=8.17.0-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.23 | <=8.20.0-r0 | Not yet available |
| alpine/curl | apk | alpine | edge | <8.21.0-r0 | 8.21.0-r0 |
| alpine/curl | apk | alpine | 3.24 | <8.21.0-r0 | 8.21.0-r0 |
| alpine/curl | apk | alpine | 3.19 | <=7.71.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.72.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.74.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.76.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.77.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.78.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.79.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.83.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.83.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.84.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.85.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.86.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.87.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.88.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.0.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.1.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.10.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.11.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.11.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.11.1-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.12.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.12.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.14.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.14.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.14.1-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.3.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.4.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.5.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.6.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.7.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.9.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.9.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.9.1-r1 | Not yet available |
Severity and metrics
No CVSS data available from this advisory.
Debian
CREATED
UPDATED
ADVISORY IDCVE-2026-9547
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AlowUbuntu
CREATED
UPDATED
ADVISORY IDCVE-2026-9547
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AlowChainguard
CREATED
UPDATED
ADVISORY ID
CGA-4787-9wp5-24vp
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
Photon
CREATED
UPDATED
ADVISORY ID
CVE-2026-9547
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
7.4highminimos
CREATED
UPDATED
ADVISORY ID
MINI-5jpx-2fcq-37cg
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
minimos
CREATED
UPDATED
ADVISORY ID
MINI-f3r3-3p4f-2rfh
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-