CVE-2026-87865: knownhost callback mismatches key as missing

How it was found

When libcurl uses libssh2 with a hashed OpenSSH known_hosts file, an unrelated first entry can make a hostile key for an already pinned SFTP/SCP host reach CURLOPT_SSH_KEYFUNCTION as CURLKHMATCH_MISSING instead of CURLKHMATCH_MISMATCH.

At https://github.com/curl/curl/blob/68720b4837284335b2d63cb358f8f6ce65f5bc55/lib/vssh/libssh2.c#L653-L687, curl treats the first hashed entry whose public name is NULL as the destination and forces that entry's key algorithm without checking its hostname hash.

With an unrelated hashed RSA entry before the target's hashed Ed25519 entry, a hostile RSA server negotiates successfully; libssh2 then filters out the Ed25519 pin and curl passes NOTFOUND to the callback as MISSING.

To reproduce on curl 8.21.0 commit 68720b4837284335b2d63cb358f8f6ce65f5bc55, build shared libcurl with cmake -S . -B build -DCURL_USE_LIBSSH2=ON -DBUILD_SHARED_LIBS=ON, extract the attachment, and run python3 poc.py --build-dir /absolute/path/to/build --output run.json.

Both exploit runs exit 0, the callback receives MISSING, the hostile server receives the password canary, and libcurl returns ATTACKER_SFTP_BODY; the target-first and same-type MISMATCH controls send no password.

This is a separate libssh2 root from CVE-2026-9547, whose advisory says libssh2 is unaffected; I used AI to assist the source audit and drafting, then personally reran the exact-release, current-master, control, and fixed-control tests.

Impact

A network attacker who controls or intercepts the reached SSH endpoint can make an already pinned host appear genuinely new to a trust-on-first-use callback. Libcurl then authenticates to the hostile endpoint; in the proof, the server receives the configured SSH password and libcurl accepts attacker-controlled SFTP data. The default callback and curl command-line tool are not claimed affected.