{"id":"CURL-CVE-2026-87862","summary":"HSTS cache import drops longer-lived child","details":"Importing a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild's valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS.","aliases":["CVE-2026-87862"],"modified":"2026-10-14T19:02:56.435318191Z","published":"2026-10-14T08:00:00Z","database_specific":{"URL":"https://curl.se/docs/CVE-2026-87862.json","www":"https://curl.se/docs/CVE-2026-87862.html","issue":"https://hackerone.com/reports/3972357","CWE":{"id":"CWE-201","desc":"Information Exposure Through Sent Data"},"last_affected":"8.22.0","severity":"Low","package":"curl","affects":"both"},"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"8.11.0"},{"fixed":"8.14.3"},{"introduced":"8.15.0"},{"fixed":"8.16.2"},{"introduced":"8.17.0"},{"fixed":"8.20.2"},{"introduced":"8.21.0"},{"fixed":"8.23.0"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"a94973805df96269bf3f3bf0a20ccb9887313316"},{"fixed":"a1614c3bcf1593eb524b37792124357d97a5429c"}]}],"versions":["8.22.0","8.21.0","8.20.0","8.19.0","8.18.0","8.17.0","8.16.0","8.15.0","8.14.1","8.14.0","8.13.0","8.12.1","8.12.0","8.11.1","8.11.0","curl-8_22_0","rc-8_22_0-3","rc-8_22_0-2","rc-8_22_0-1","curl-8_21_0","rc-8_21_0-3","rc-8_21_0-2","rc-8_21_0-1","curl-8_20_0","rc-8_20_0-3","rc-8_20_0-2","rc-8_20_0-1","curl-8_19_0","rc-8_19_0-3","rc-8_19_0-2","rc-8_19_0-1","curl-8_18_0","rc-8_18_0-3","rc-8_18_0-2","rc-8_18_0-1","curl-8_17_0","curl-8_16_0","curl-8_15_0","curl-8_14_1","curl-8_14_0","curl-8_13_0","curl-8_12_1","curl-8_12_0","curl-8_11_1","curl-8_11_0"],"database_specific":{"source":"https://curl.se/docs/CURL-CVE-2026-87862.json","vanir_signatures":[{"digest":{"line_hashes":["224427400684326249590822012963350597075","2737065825097435213544451821822622621","214650631889071362966467564430717118548","116082283867178258548291069737951800414"],"threshold":0.9},"id":"CURL-CVE-2026-87862-9ffd2bf3","signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/a1614c3bcf1593eb524b37792124357d97a5429c","target":{"file":"lib/hsts.c"},"deprecated":false},{"source":"https://github.com/curl/curl.git/commit/a1614c3bcf1593eb524b37792124357d97a5429c","target":{"file":"lib/hsts.c","function":"hsts_add_host_expire"},"deprecated":false,"digest":{"function_hash":"256221136634413402692360369980878541334","length":966},"id":"CURL-CVE-2026-87862-c6e9f2fa","signature_type":"Function","signature_version":"v1"}],"vanir_signatures_modified":"2026-10-14T19:02:56Z"}}],"schema_version":"1.9.0","credits":[{"name":"Stanislav Fort (Aisle Research)","type":"FINDER"},{"name":"Daniel Stenberg","type":"REMEDIATION_DEVELOPER"}]}