The CVE involves the libcurl library mis‑enforcing SSH host key validation when using the CURLOPT_SSH_KEYFUNCTION callback for SCP or SFTP transfers. When a server presents a host key type that does not match the type already recorded for that host in the known_hosts file, the callback silently allows the connection. This weakness, classified as CWE‑347, permits an attacker who controls an impersonating SSH server to conduct a man‑in‑the‑middle attack without the client being alerted.

Any application that bundles the SFTP transfers with the CURLOPT_SSH_KEYFUNCTION callback is potentially vulnerable. The product is the c is provided, so administrators must verify whether their installed libcurl contains the flaw.

The CVSS score of 7.4 indicates high severity, while an EPSS score below 1 % The vulnerability is not listed in CISA KEV. Exploitation requires an attacker to impersonate an SSH server presenting a mismatched host key type; the client will accept the connection silently.