Submit finding

All findings

argus-curl-ssh-connection-reuse high

Argus finds SSH identity confusion in libcurl connection reuse

libcurl could reuse an SSH or SFTP connection authenticated with a different key, causing a later request to execute under the wrong identity.

Bug class
Authentication-context confusion in connection pooling
Affected codebase
curl / libcurl
Credited system
Argus
Disclosed
June 8, 2026
Attribution
Self-reported attribution
Severity
high
Source status: Argus's public tracker marks the report Disclosed, documents the vulnerable flow, and links the upstream curl fix. No CVE or independent AI-attribution source was public at indexing time.

Summary

libcurl’s connection-pool matching did not compare the SSH public/private-key configuration for a new request with the context of an existing connection. When two SSH or SFTP requests targeted the same destination with different key settings, the second could silently reuse the first request’s authenticated channel and operate as the wrong identity.

The public disclosure points to the upstream repair that restored SSH configuration matching. It is counted without a CVE because the accepted, fixed report is public and sufficiently specific; the AI role remains an operator claim.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.