A flaw in the curl command‑line tool causes it to ignore user‑specified SSH host verification options when following redirects to SFTP or SCP destinations. When curl receives a redirect, it fails to apply host‑verification settings for the subsequent SFTP or SCP connection, allowing the remote host’s identity to be unchecked. This gives an attacker a route to conduct a man‑in‑the‑middle or data tampering attack against a user who trusts the redirect source, potentially exposing or modifying transferred data.

The affected product is curl, as identified by the CNA. The bug is present in the curl version that is packaged by RedHat in the Hummingbird distribution, but no specific curl release or patch level is specified in the CVE data.

The CVSS score of 8.1 indicates high severity, and the EPSS score is 0.00252 (equivalent to < 1%), while the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote server that issues an HTTP redirect to a malicious SFTP or SCP endpoint. An attacker must control the initial server to return a redirect that points curl to an untrusted SSH host; utilization of the -L (follow redirects) option or any redirect processing in curl can enable exploitation. No widespread evidence of active exploitation is currently noted, but the conditions for exploitation are readily achievable when users supply URLs that may redirect to SFTP or SCP targets.