Curl misinterprets a schemeless URL when the --proto-default option is set to sftp or scp, causing the tool layer to omit critical SSH security options, an improper certificate validation (CWE-295) that bypasses the expected SSH host verification. The result is a connection to a remote host without performing host key verification, which means a man‑in‑the‑middle attacker could intercept or alter the transferred data. The potential for such an attack is inferred from the fact that the client silently suppresses key verification, rather than from explicit exploit evidence in the advisory.

All builds of curl that implement the --proto-default option for sftp or scp and accept schemeless URLs are vulnerable. Because no specific version ranges are listed, any current release supporting this feature should be treated as at risk until the fix is applied.

The CVSS score of 7.5 indicates a high severity vulnerability. This is an improper certificate validation (CWE-295) failure that allows a man‑in‑the‑middle attack by bypassing SSH host verification. The EPSS score of less than 1% shows a low likelihood of widespread exploitation. As the issue is not listed in the CISA KEV catalog, it is not known to be actively exploited. Exploitation requires an attacker to provide or control the remote SSH host, allowing a man‑in‑the‑middle or similar attack if the user does not see a verification failure.