When libcurl uses libssh2 with a hashed known_hosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPT_SSH_KEYFUNCTION callback. This misclassification prevents proper detection of an incorrect public key, allowing a malicious host to masquerade as a legitimate server, potentially redirecting SSH connections to an untrusted host.

All installations of libcurl that are configured with the libssh2 backend and use a hashed known-hosts file are affected. No specific version numbers are provided, so any build with this configuration is susceptible.

The CVSS score of 7.4 indicates high severity, and the EPSS score of < 1% indicates a low exploitation probability. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the likely attack vector involves a remote attacker controlling or intercepting SSH traffic, manipulating the SSH session to present a forged host key. If successful, the application may authenticate to a malicious server, compromising confidentiality integrity.