Cyber Resilience

CVE-2026-9547

Haxx Curl 7.69.0 – 8.21.0

Public PoC
Published
03 July 2026
Modified
07 July 2026
Patch / advisory
View advisory
CVSS Score v3.1 7.4
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0032 25th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-9547 is a high-severity an unspecified weakness vulnerability in Haxx Curl. Its CVSS base score is 7.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 25th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SC-23 (Session Authenticity) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key…

more

type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.

CWE(s)
NVD-CWE-Other

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
attack.mitre.org →
Why these techniques?

Bypasses SSH host key verification in libcurl SFTP/SCP transfers, directly enabling adversary-in-the-middle attacks.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1557 Adversary-in-the-Middle Credential Accessconfidence: HIGH
The vulnerability allows silent acceptance of an untrusted SSH host key, enabling an adversary-in-the-middle attack during SCP/SFTP transfers.
attack.mitre.org →
T1557.001 Name Resolution Poisoning and SMB Relay Credential Accessconfidence: MEDIUM
The flaw specifically facilitates name-resolution or host-key poisoning scenarios where a malicious server can impersonate a legitimate host.
attack.mitre.org →
inferred from description · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-7009Same product: Haxx Curl
CVE-2026-8286Same product: Haxx Curl
CVE-2026-11564Same product: Haxx Curl
CVE-2026-9545Same product: Haxx Curl
CVE-2026-7168Same product: Haxx Curl
CVE-2026-4873Same product: Haxx Curl
CVE-2026-8932Same product: Haxx Curl
CVE-2025-5399Same product: Haxx Curl
CVE-2026-6429Same product: Haxx Curl
CVE-2025-10966Same product: Haxx Curl

Affected Assets

haxx
curl
7.69.0 — 8.21.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • SC-23 Session Authenticity
  • IA-3 Device Identification and Authentication
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Enforces rejection of SSH host keys that do not match the known_hosts entry, directly blocking the silent acceptance path described in the CVE.

SC-23 Session Authenticity good match
prevent

Requires cryptographic verification of session authenticity for SCP/SFTP transfers, preventing the MITM condition when key-type mismatches occur.

IA-3 Device Identification and Authentication partial match
prevent

Mandates device (host) identification and authentication before allowing SCP/SFTP sessions, addressing the flawed callback behavior with untrusted server keys.

References