CVE-2025-15079: Haxx Curl

Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days.

When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file.

Affected products

• Haxx Curl: from 7.58.0, before 8.18.0 (fixed in 8.18.0)

Published 2026-01-08. Last modified 2026-09-15.