A flaw in libcurl built with the libssh2 backend and a hashed known-hosts file causes host key verification to incorrectly report a key mismatch as a missing key to custom verification callbacks. This misreporting allows a remote attacker controlling or intercepting the SSH session to make an already pinned server appear as a new host, potentially leading the application to authenticate to an untrusted server and exposing credentials and malicious data.

All installations of libcurl that are configured with the libssh2 backend and use a hashed known-hosts file are affected. No specific version numbers are provided, so any build with this configuration is susceptible.

The CVSS score of 3.7 indicates moderate severity, and the EPSS score is not available, suggesting a low exploitation probability at this time. The vulnerability is not listed in CISA KEV. The likely attack vector is a remote attacker who controls or intercepts the SSH traffic; exploitation requires manipulating the SSH session to present a forged host key, after which the application may authenticate to a malicious server, leading to credential exposure and potential data compromise.