Red Hat issued a security advisory (RHSA-2026:29017) updating Red Hat Hardened Images RPMs, including curl 8.21.0-0.1.hum1 and related packages, to address multiple vulnerabilities such as CVE-2026-12064. This specific vulnerability in curl allows an attacker to bypass SSH host verification when a user invokes curl with a schemeless URL and specifies SFTP or SCP as the default protocol, leading to potential man-in-the-middle attacks. The advisory includes updated RPMs for aarch64 and x86_64 architectures. The vendor advisory explicitly recommends avoiding the use of --proto-default sftp or scp with schemeless URLs and instead specifying the protocol explicitly. No explicit patch links were provided, but updated packages are available from Red Hat's repositories. The advisory does not indicate known exploits in the wild.

The vulnerability CVE-2026-12064 allows bypassing SSH host verification in curl when using schemeless URLs with SFTP or SCP default protocols. This can enable attackers to perform man-in-the-middle attacks, potentially intercepting or manipulating data without user awareness. The overall impact is high due to the integrity compromise risk. Other vulnerabilities addressed in the update are not detailed in the provided data.

Red Hat provides updated RPM packages for curl and related libraries as part of the Hardened Images update. Users should apply these updates from Red Hat's official repositories. Additionally, to mitigate CVE-2026-12064, users should avoid using the --proto-default sftp or scp options with schemeless URLs in curl commands and explicitly specify the protocol in the URL (e.g., sftp://host/path). Patch status is not explicitly confirmed in the advisory text, so users should consult Red Hat's errata and update channels for the latest fixes.