When the curl command‑line client is invoked with a schemeless URL and the --proto-default option set to sftp or scp, the tool layer incorrectly infers the URL scheme and omits critical SSH host verification options such as CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. This causes curl to establish a connection without checking the remote host’s key, allowing a man‑in‑the‑middle attack without raising an error. The flaw is classified as CWE‑358, indicating the removal of vital security controls.

All versions of the curl command‑line client that support the --proto-default option for sftp or scp and accept schemeless URLs are potentially affected. No specific version ranges are provided in the advisory, so every release that implements this feature should be considered vulnerable until a patch is applied.

The CVSS score of 7.5 reflects a high severity impact, while the EPSS score of less than 1% indicates a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to intentionally invoke curl with the vulnerable configuration, which makes automated attacks unlikely. The silent bypass of SSH host verification compromises confidentiality and integrity of data transferred to the remote host.