When libcurl uses libssh2 with a hashed known_hosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a… (CVE-2026-87865)

When libcurl uses libssh2 with a hashed known_hosts file, an unrelated initial entry can cause the host key validation process to report a key mismatch as a missing key to the CURLOPT_SSH_KEYFUNCTION callback. This behavior may affect the accuracy of host key validation during SSH connections.

The vulnerability causes incorrect reporting of host key validation status, potentially misleading applications relying on the CURLOPT_SSH_KEYFUNCTION callback about the presence or mismatch of host keys. There is no indication of direct compromise or exploitation in the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is provided in the available data.