CVE-2026-87862

UNKNOWN 0.0

HSTS cache import drops longer-lived child

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.

Vendor	curl
Product	curl
Published	Oct 20, 2026

Stay Ahead of the Next One

Get instant alerts for curl curl

Be the first to know when new unknown vulnerabilities affecting curl curl are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

curl / curl

8.22.0 ≤ 8.22.0 8.21.0 ≤ 8.21.0 8.20.0 ≤ 8.20.0 8.19.0 ≤ 8.19.0 8.18.0 ≤ 8.18.0 8.17.0 ≤ 8.17.0 8.16.0 ≤ 8.16.0 8.15.0 ≤ 8.15.0 8.14.1 ≤ 8.14.1 8.14.0 ≤ 8.14.0 8.13.0 ≤ 8.13.0 8.12.1 ≤ 8.12.1 8.12.0 ≤ 8.12.0 8.11.1 ≤ 8.11.1 8.11.0 ≤ 8.11.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

curl.se: https://curl.se/docs/CVE-2026-87862.json curl.se: https://curl.se/docs/CVE-2026-87862.html hackerone.com: https://hackerone.com/reports/3972357

Credits

Stanislav Fort (Aisle Research) Daniel Stenberg