---
id: CVE-2026-12064
title: |-
  When a user invokes curl using a schemeless URL combined with
  `--proto-default` sftp (or scp), a disconnect occurs between the tool layer
  and libcurl
summary: |-
  When a user invokes curl using a schemeless URL combined with
  `--proto-default` sftp (or scp), a disconnect occurs between the tool layer
  and libcurl. The tool layer incorrectly infers the URL scheme, which
  erroneously bypasses the initi…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-297
  - CWE-295
  - CWE-358
vendor: haxx
product: curl
affected:
  - 'curl >= 7.81.0, < 8.21.0'
patched:
  - curl 8.21.0
published: '2026-07-03'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T07:16:26.150'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-12064'
references:
  - url: 'https://curl.se/docs/CVE-2026-12064.html'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://curl.se/docs/CVE-2026-12064.json'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://hackerone.com/reports/3797526'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://hackerone.com/reports/3797526'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12064.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-12064'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2496768'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-12064'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-12064'
  - url: 'https://access.redhat.com/errata/RHSA-2026:55450'
  - url: 'https://access.redhat.com/errata/RHSA-2026:29017'
  - url: 'https://access.redhat.com/errata/RHSA-2026:34975'
tags:
  - nvd
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-07-06T18:19:34.951461Z'
epss: 0.00399
epssPercentile: 0.31447
ingestedAt: '2026-07-04T04:55:39.427Z'
---

## Overview

When a user invokes curl using a schemeless URL combined with
`--proto-default` sftp (or scp), a disconnect occurs between the tool layer
and libcurl. The tool layer incorrectly infers the URL scheme, which
erroneously bypasses the initialization of critical SSH security options like
CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the
libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes
the connection via SFTP/SCP as specified. Because the tool layer skipped the
security configuration, these SSH host verification options are silently
omitted, causing curl to connect to an unverified SSH remote host without
throwing an error.

## Affected

- `curl >= 7.81.0, < 8.21.0`

## Remediation

Upgrade past the affected range:

- `curl 8.21.0`

## Vendor advisories

- **RHSA-2026:55450** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-08-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:55450)
- **RHSA-2026:29017** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:29017)
- **RHSA-2026:34975** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:34975)