{"id":"AZL-110307","summary":"CVE-2026-87863 affecting package tensorflow 2.16.1-11","details":"An authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss.","modified":"2026-10-27T05:36:16Z","published":"2026-10-20T21:17:20Z","upstream":["CVE-2026-87863"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87863"}],"affected":[{"package":{"name":"tensorflow","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/tensorflow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.16.1-11"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-110307.json"}}],"schema_version":"1.9.2"}