Curl misinterprets a schemeless URL when the --proto-default option is set to sftp or scp, causing the tool layer to omit critical SSH security options and resulting in an improper certificate validation (CWE-295), an insecure authentication scenario (CWE-297), and a failure to enforce secure communication principles (CWE-358). The client silently suppresses the SSH host key verification that would normally guard against man‑in‑the‑middle attacks, allowing an attacker to intercept or alter data transferred to an unverified remote host.

All builds of curl that implement the --proto-default option for sftp or scp and accept schemeless URLs are vulnerable. Because no specific version ranges are listed, any current release supporting this feature should be treated as at risk until the fix is applied.

The CVSS score of 7.5 indicates a high severity vulnerability. The exploitability is low, with an EPSS score of less than 1%, and the issue is not listed in the CISA KEV catalog. The vulnerability requires an attacker to control or provide the remote SSH host to successfully intercept traffic. An attacker could exploit the bypassed host key verification to perform a man‑in‑the‑middle attack, but active exploitation evidence is not reported.