Change #278694

Category	None
Changed by	Joshua Rogers <MegaManSecohnoyoudont@users.noreply.github.com>
Changed at	Tue 18 Aug 2026 08:20:44
Repository	https://api.github.com/repos/curl/curl
Project	curl/curl
Branch	curl-8.20.X
Revision	c80e9431adb4e84d10fc098eb20195b3f3026597

Comments

CVE-2026-9547: SSH improper host validation

Cherry-picked from 0b8dbbc63c98777e4584cb9

libssh: map SSH_KNOWN_HOSTS_OTHER to CURLKHMATCH_MISMATCH

Host key type mismatch from libssh was incorrectly reported as missing,
causing key callbacks to accept instead of reject.

Reported by: Joshua Rogers (Aisle Research)
Closes #21724

Changed files

lib/vssh/libssh.c