{"id":"CURL-CVE-2026-87863","summary":"HSTS response erases persisted entries","details":"An authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss.","aliases":["CVE-2026-87863"],"modified":"2026-10-14T19:02:56.843808778Z","published":"2026-10-14T08:00:00Z","database_specific":{"package":"curl","affects":"both","URL":"https://curl.se/docs/CVE-2026-87863.json","www":"https://curl.se/docs/CVE-2026-87863.html","issue":"https://hackerone.com/reports/3972373","CWE":{"id":"CWE-201","desc":"Information Exposure Through Sent Data"},"last_affected":"8.22.0","severity":"Low"},"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"8.2.0"},{"fixed":"8.14.3"},{"introduced":"8.15.0"},{"fixed":"8.16.2"},{"introduced":"8.17.0"},{"fixed":"8.20.2"},{"introduced":"8.21.0"},{"fixed":"8.23.0"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"0c667188e0c6cda615a036b8a2b4125f2c404dde"},{"fixed":"08d50a791b3197a3d0a4fc2f778e243f5501c67e"}]}],"versions":["8.22.0","8.21.0","8.20.0","8.19.0","8.18.0","8.17.0","8.16.0","8.15.0","8.14.1","8.14.0","8.13.0","8.12.1","8.12.0","8.11.1","8.11.0","8.10.1","8.10.0","8.9.1","8.9.0","8.8.0","8.7.1","8.7.0","8.6.0","8.5.0","8.4.0","8.3.0","8.2.1","8.2.0","curl-8_22_0","rc-8_22_0-3","rc-8_22_0-2","rc-8_22_0-1","curl-8_21_0","rc-8_21_0-3","rc-8_21_0-2","rc-8_21_0-1","curl-8_20_0","rc-8_20_0-3","rc-8_20_0-2","rc-8_20_0-1","curl-8_19_0","rc-8_19_0-3","rc-8_19_0-2","rc-8_19_0-1","curl-8_18_0","rc-8_18_0-3","rc-8_18_0-2","rc-8_18_0-1","curl-8_17_0","curl-8_16_0","curl-8_15_0","curl-8_14_1","curl-8_14_0","curl-8_13_0","curl-8_12_1","curl-8_12_0","curl-8_11_1","curl-8_11_0","curl-8_10_1","curl-8_10_0","curl-8_9_1","curl-8_9_0","curl-8_8_0","curl-8_7_1","curl-8_7_0","curl-8_6_0","curl-8_5_0","tiny-curl-8_4_0","curl-8_4_0","curl-8_3_0","curl-8_2_1","curl-8_2_0"],"database_specific":{"vanir_signatures_modified":"2026-10-14T19:02:56Z","source":"https://curl.se/docs/CURL-CVE-2026-87863.json","vanir_signatures":[{"target":{"file":"lib/hsts.c","function":"Curl_hsts_save"},"deprecated":false,"digest":{"function_hash":"130716959620459958849575900228284574811","length":1254},"id":"CURL-CVE-2026-87863-0af9106b","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/08d50a791b3197a3d0a4fc2f778e243f5501c67e"},{"deprecated":false,"digest":{"function_hash":"235220928436855776497358132967032028485","length":551},"id":"CURL-CVE-2026-87863-3febfe18","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/08d50a791b3197a3d0a4fc2f778e243f5501c67e","target":{"file":"lib/hsts.c","function":"hsts_out"}},{"digest":{"line_hashes":["205178578720782544809538152978818913426","312232802905811482719156969745540983201","52024235586103044253478741981586349101","236670464565528813889296099301380617367","201698613823396007419677165466361661252","203881905030976409994234000584428003258","305083743043698032842437395492136388136","63780816154108311112287374066842202840","179606117275867453032594657296301292822","151193636400008653907531872018138587740","282941625750189441312039289710905698168","17557605789080997805808072397361704561","196264846599574655196860071710318067926","27093778555667850506274057291081042750","158079286993560261561536269313577311136","81855407285355430608706587545584654329","297366706571649341920083432355046071941","209662935018479864666392652983395213507","76164040816556869285329144294969932364","128562461603798141764926661314467138368","233917221121809993590827497351614816244","163877588095670458562943243143001700315","8334112328983392380704498149061936935","334545719184409274706574087080948536627","297596397871360914227453585870758356407","307050522064000661156627064896784888289","271841489615894496984986059155513402280","254925658198740085909971059161145530467","271276513996856353440083033981125880048","311554679248225155931659386580554936031","243788162621962468038868913053961555140","311036978655299673885270247871030631148","18713085383729949029225011990466382721","4660003201131665093028710170592646961"],"threshold":0.9},"id":"CURL-CVE-2026-87863-4e8b645f","signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/08d50a791b3197a3d0a4fc2f778e243f5501c67e","target":{"file":"lib/hsts.c"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/08d50a791b3197a3d0a4fc2f778e243f5501c67e","target":{"file":"lib/hsts.c","function":"Curl_hsts_parse"},"deprecated":false,"digest":{"function_hash":"96308156130170861737261897291227074129","length":1674},"id":"CURL-CVE-2026-87863-d434713a"}]}}],"schema_version":"1.9.0","credits":[{"name":"Stanislav Fort (Aisle Research)","type":"FINDER"},{"name":"Daniel Stenberg","type":"REMEDIATION_DEVELOPER"}]}