CVE-2026-12064

When a user invokes curl using a schemeless URL combined with<br /> `--proto-default` sftp (or scp), a disconnect occurs between the tool layer<br /> and libcurl. The tool layer incorrectly infers the URL scheme, which<br /> erroneously bypasses the initialization of critical SSH security options like<br /> CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the<br /> libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes<br /> the connection via SFTP/SCP as specified. Because the tool layer skipped the<br /> security configuration, these SSH host verification options are silently<br /> omitted, causing curl to connect to an unverified SSH remote host without<br /> throwing an error.