CVE-2025-15224: Haxx Curl

Low severity, CVSS 3.1. EPSS: 0.5% chance of exploitation in the next 30 days.

When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.

Affected products

• Haxx Curl: from 7.58.0, before 8.18.0 (fixed in 8.18.0)

Published 2026-01-08. Last modified 2026-09-15.