Home

Description

When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.

PUBLISHED Reserved 2025-12-28 | Published 2026-01-08 | Updated 2026-01-08 | Assigner curl

Problem types

CWE-287 Improper Authentication

Product status

Default status
unaffected

8.17.0 (semver)
affected

8.16.0 (semver)
affected

8.15.0 (semver)
affected

8.14.1 (semver)
affected

8.14.0 (semver)
affected

8.13.0 (semver)
affected

8.12.1 (semver)
affected

8.12.0 (semver)
affected

8.11.1 (semver)
affected

8.11.0 (semver)
affected

8.10.1 (semver)
affected

8.10.0 (semver)
affected

8.9.1 (semver)
affected

8.9.0 (semver)
affected

8.8.0 (semver)
affected

8.7.1 (semver)
affected

8.7.0 (semver)
affected

8.6.0 (semver)
affected

8.5.0 (semver)
affected

8.4.0 (semver)
affected

8.3.0 (semver)
affected

8.2.1 (semver)
affected

8.2.0 (semver)
affected

8.1.2 (semver)
affected

8.1.1 (semver)
affected

8.1.0 (semver)
affected

8.0.1 (semver)
affected

8.0.0 (semver)
affected

7.88.1 (semver)
affected

7.88.0 (semver)
affected

7.87.0 (semver)
affected

7.86.0 (semver)
affected

7.85.0 (semver)
affected

7.84.0 (semver)
affected

7.83.1 (semver)
affected

7.83.0 (semver)
affected

7.82.0 (semver)
affected

7.81.0 (semver)
affected

7.80.0 (semver)
affected

7.79.1 (semver)
affected

7.79.0 (semver)
affected

7.78.0 (semver)
affected

7.77.0 (semver)
affected

7.76.1 (semver)
affected

7.76.0 (semver)
affected

7.75.0 (semver)
affected

7.74.0 (semver)
affected

7.73.0 (semver)
affected

7.72.0 (semver)
affected

7.71.1 (semver)
affected

7.71.0 (semver)
affected

7.70.0 (semver)
affected

7.69.1 (semver)
affected

7.69.0 (semver)
affected

7.68.0 (semver)
affected

7.67.0 (semver)
affected

7.66.0 (semver)
affected

7.65.3 (semver)
affected

7.65.2 (semver)
affected

7.65.1 (semver)
affected

7.65.0 (semver)
affected

7.64.1 (semver)
affected

7.64.0 (semver)
affected

7.63.0 (semver)
affected

7.62.0 (semver)
affected

7.61.1 (semver)
affected

7.61.0 (semver)
affected

7.60.0 (semver)
affected

7.59.0 (semver)
affected

7.58.0 (semver)
affected

Credits

Harry Sintonen finder

Harry Sintonen remediation developer

References

www.openwall.com/lists/oss-security/2026/01/07/7

curl.se/docs/CVE-2025-15224.json (json)

curl.se/docs/CVE-2025-15224.html (www)

hackerone.com/reports/3480925 (issue)

cve.org (CVE-2025-15224)

nvd.nist.gov (CVE-2025-15224)

Download JSON