The vulnerability involves libcurl performing SCP or SFTP transfers using the CURLOPT_SSH_KEYFUNCTION callback. When a server presents a host key type that does not match the already recorded type for that host in the known_hosts file, the callback fails to enforce the mismatch, allowing the connection to succeed silently and exposing the setup to a potential man‑in‑the‑middle attack. The description does not include affected‑version data, so the scope across libcurl releases remains unclear.

Any application that bundles libcurl and enables SCP or SFTP transfers with the CURLOPT_SSH_KEYFUNCTION callback is potentially vulnerable. The affected vendor is curl, product libcurl; version information is unavailable, so administrators must verify whether their installed libcurl contains the flaw.

The CVSS score of 7.4 indicates a high severity. With an EPSS score below 1 %, active exploitation is expected to be rare, and the vulnerability is not listed in CISA KEV. The attack vector requires an attacker to control or impersonate an SSH server presenting a mismatched host key type. If the application accepts the connection without warning, the attacker can intercept or tamper with traffic, compromising confidentiality and integrity.