CVE-2026-9547

Publication date 24 June 2026

Last updated 9 July 2026

Ubuntu priority

Low

Why this priority?

Cvss 3 Severity Score

7.4 · High

Score breakdown

Description

When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.

Why is this CVE low priority?

Upstream defined this as low severity

Learn more about Ubuntu priority

Status

Package Ubuntu Release Status
curl 26.10 stonking
Not affected
26.04 LTS resolute
Fixed in 8.18.0-1ubuntu2.2
25.10 questing
Fixed in 8.14.1-2ubuntu1.4
24.04 LTS noble
Fixed in 8.5.0-2ubuntu10.10
22.04 LTS jammy
Fixed in 7.81.0-1ubuntu1.25
20.04 LTS focal
Not affected
18.04 LTS bionic
Not affected
16.04 LTS xenial
Not affected
14.04 LTS trusty
Not affected

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
curl

Severity score breakdown

CVSS version: CVSS v3.0

Base score 7.4 · High

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

Related Ubuntu Security Notices (USN)

Other references

Access our resources on patching vulnerabilities