A flaw in the curl command‑line tool causes it to ignore user‑specified SSH host verification settings when following redirects to Secured File Transfer Protocol (SFTP) or Secure Copy Protocol (SCP) destinations. This allows a malicious server to redirect a curl request to an untrusted SFTP or SCP server, causing the connection to succeed without validating the remote host’s identity. An attacker can then intercept or tamper with transferred data, leading to sensitive information disclosure. The weakness is categorized as CWE‑297, a violation of authentication or access control by bypassing host verification.

The affected product identified by the CNA is RedHat Hummingbird version 1, which includes the curl implementation that contains this bug. No other affected versions were listed in the provided data.

The CVSS score of 6.8 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote server that a user contacts via curl; the attacker can control that server’s response to issue a redirect to a malicious SFTP or SCP endpoint. Because the flaw manifests only when curl follows redirects for these protocols, exploitation requires the user to initiate a curl session that follows the redirect. No widespread evidence of active exploitation exists as of this analysis.