When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2f88b83676 advisory.

    - Fix QUIC zero-length UDP datagrams busy-loop (CVE-2026-11352)
    - Fix WS Auto-PONG memory exhaustion (CVE-2026-11586)
    - Fix proto-default skips SSH verification (CVE-2026-12064)
    - Fix wrong STARTTLS connection reuse (CVE-2026-8286)
    - Fix SASL double-free (CVE-2026-8925)
    - Fix env-set cross-proxy Digest auth state leak (CVE-2026-8927)
    - Fix sending old referer (CVE-2026-9546)
    - Fix exposing HTTP/3 early data (CVE-2026-9545)
    - Fix UAF after pause in socket callback (CVE-2026-9080)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Security Center running on the remote host is prior to 6.9.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-22 advisory.

  - libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a     pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.
    When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network     transfer operation that was requested by an application could wrongfully reuse an existing SMB connection     to the same server that was using a different 'share' than the new subsequent transfer should. This could     in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place.
    When this happens, the same credentials are used and the server name is the same. (CVE-2026-5773)

  - libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of     them matches the setup. An easy handle that first uses default native CA trust can continue trusting the     native platform store after the application switches that same handle to custom CA material for a later     transfer. (CVE-2026-11564)

  - A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker     could exploit this issue to execute arbitrary commands on the underlying operating system with the     privileges of the service account. (CVE-2026-19682)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55450 advisory.

    - fix proxy environment variable change detection (CVE-2026-8927)
    - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965)
    - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783)
    - fix proxy connection reuse with wrong credentials (CVE-2026-3784)
    - fix SSH host key mismatch on type difference (CVE-2026-9547)
    - fix schemeless URL handling with --proto-default (CVE-2026-12064)
    - fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55450 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: libcurl: Improper certificate validation due to cached TLS settings reuse (CVE-2025-14819)

    * curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication     (CVE-2026-1965)

    * curl: curl: Unauthorized access due to improper HTTP proxy connection reuse (CVE-2026-3784)

    * curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect     (CVE-2026-3783)

    * curl: curl: Man-in-the-middle attack via SSH host key bypass (CVE-2026-9547)

    * curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286)

    * curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP (CVE-2026-12064)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3043-1 advisory.

    This update for curl fixes the following issues

    - CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
    - CVE-2026-8458: wrong reuse for different services (bsc#1268407).
    - CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
    - CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
    - CVE-2026-9079: stale proxy password leak (bsc#1268415).
    - CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
    - CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
    - CVE-2026-9547: SSH improper host validation (bsc#1268420).
    - CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
    - CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2925-1 advisory.

    This update for curl fixes the following issues

    - CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631).
    - CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
    - CVE-2026-8458: wrong reuse for different services (bsc#1268407).
    - CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
    - CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
    - CVE-2026-9079: stale proxy password leak (bsc#1268415).
    - CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
    - CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
    - CVE-2026-9547: SSH improper host validation (bsc#1268420).
    - CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
    - CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2926-1 advisory.

    This update for curl fixes the following issues

    - CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
    - CVE-2026-8458: wrong reuse for different services (bsc#1268407).
    - CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
    - CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
    - CVE-2026-9079: stale proxy password leak (bsc#1268415).
    - CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
    - CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
    - CVE-2026-9547: SSH improper host validation (bsc#1268420).
    - CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
    - CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21272-1 advisory.

    This update for curl fixes the following issues

    - CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
    - CVE-2026-8458: wrong reuse for different services (bsc#1268407).
    - CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
    - CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
    - CVE-2026-9079: stale proxy password leak (bsc#1268415).
    - CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
    - CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
    - CVE-2026-9547: SSH improper host validation (bsc#1268420).
    - CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
    - CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8525-1 advisory.

    Harry Sintonen discovered that curl incorrectly handled credentials when following HTTP redirects in     conjunction with .netrc files. An attacker could possibly use this issue to obtain sensitive information.
    This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2024-11053)

    Hiroki Kurosawa discovered that curl incorrectly handled OCSP stapling responses. A remote attacker could     possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS and     Ubuntu 18.04 LTS. (CVE-2024-8096)

    Joshua Rogers discovered that curl had a use-after-free vulnerability when resetting and cleaning up     HTTP/2 stream handles. An attacker could possibly use this issue to cause a denial of service or execute     arbitrary code. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10.
    (CVE-2026-10536)

    Quac Tran and Ngoc Hieu discovered that curl incorrectly reused connections when switching authentication     methods to the same host. An attacker could possibly use this issue to obtain sensitive information or     perform unauthorized actions. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-5545)

    Osama Hamad discovered that curl incorrectly reused SMB connections when the target share differed between     transfers. An attacker could possibly use this issue to obtain sensitive information. This issue only     affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-5773)

    Muhamad Arga Reksapati discovered that curl incorrectly forwarded Digest proxy authentication credentials     to a different proxy host. An attacker could possibly use this issue to obtain sensitive information. This     issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-7168)

    It was discovered that curl incorrectly skipped SSH host verification options when using schemeless URLs     with --proto-default. An attacker could possibly use this issue to perform machine-in-the-middle attacks.
    This issue only affected Ubuntu 25.04 and Ubuntu 25.10. (CVE-2026-12064)

    It was discovered that curl did not enforce an upper bound on memory allocated for unacknowledged     WebSocket PING frames. A remote attacker could possibly use this issue to cause a denial of service. This     issue only affected Ubuntu 25.10. (CVE-2026-11586)

    It was discovered that curl could stall indefinitely when a malicious HTTP/3 server sent a continuous     stream of empty UDP datagrams. A remote attacker could possibly use this issue to cause a denial of     service. This issue only affected Ubuntu 25.10. (CVE-2026-11352)

    It was discovered that curl could incorrectly continue trusting a native platform CA store after an     application switched the handle to use custom CA material. An attacker could possibly use this issue to     obtain sensitive information. This issue only affected Ubuntu 25.10. (CVE-2026-11564)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote host is 7.81.0 prior to 8.21.0. It is, therefore, affected by an improper host validation vulnerability:

  - When a user invokes curl using a schemeless URL combined with --proto-default sftp, a disconnect occurs     that erroneously bypasses the initialization of critical SSH security options. (CVE-2026-12064)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a     disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme,     which erroneously bypasses the initialization of critical SSH security options like     CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime     successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified.
    Because the tool layer skipped the security configuration, these SSH host verification options are     silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.
    (CVE-2026-12064)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
340980	Fedora 44 : curl (2026-2f88b83676)	Nessus	Fedora Local Security Checks	Local	critical
339129	Tenable Security Center < 6.9.0 Multiple Vulnerabilities (TNS-2026-22)	Nessus	Misc.	Combined	critical
338021	Oracle Linux 10 : curl (ELSA-2026-55450)	Nessus	Oracle Linux Local Security Checks	Local	high
335952	RHEL 10 : curl (RHSA-2026:55450)	Nessus	Red Hat Local Security Checks	Local	high
333502	Photon OS 4.0: Curl PHSA-2026-4.0-1061	Nessus	PhotonOS Local Security Checks	Local	critical
327284	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:3043-1)	Nessus	SuSE Local Security Checks	Local	critical
326957	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:2925-1)	Nessus	SuSE Local Security Checks	Local	critical
326933	SUSE SLES15 Security Update : curl (SUSE-SU-2026:2926-1)	Nessus	SuSE Local Security Checks	Local	critical
326418	openSUSE 16: curl / curl-fish-completion / curl-zsh-completion / libcurl-devel / etc (openSUSE-SU-2026:21272-1)	Nessus	SuSE Local Security Checks	Local	critical
326253	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 24.04 LTS / 26.04 LTS : curl vulnerabilities (USN-8525-1)	Nessus	Ubuntu Local Security Checks	Local	high
323014	Curl 7.81.0 < 8.21.0 Proto-Default Skips SSH Verification	Nessus	Misc.	Local	high
322467	Linux Distros Unpatched Vulnerability : CVE-2026-12064	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-12064

high

Tenable Plugins

critical

critical

high

high

critical

critical

critical

critical

critical

high

high

high