CVE-2026-87862
HSTS cache import drops longer-lived child
Project curl Security Advisory, October 14 2026 Permalink
VULNERABILITY
Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.
INFO
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-87862 to this issue.
CWE-201: Information Exposure Through Sent Data
Severity: Low
AFFECTED VERSIONS
- Affected versions: curl 8.11.0 to and including 8.22.0
- Not affected versions: curl < 8.11.0 and >= 8.23.0
- Not affected versions: curl >= 8.20.2 in the 8.20.X branch
- Not affected versions: curl >= 8.16.2 in the 8.16.X branch
- Not affected versions: curl >= 8.14.3 in the 8.14.X branch
- Introduced-in: https://github.com/curl/curl/commit/a94973805df96269bf3f3bf0a2
libcurl is used by many applications, but not always advertised as such!
This flaw also affects the curl command line tool.
SOLUTION
RECOMMENDATIONS
A - Upgrade curl to version 8.23.0
B - Apply the patch to your local version
C - Do not rely on HSTS
TIMELINE
This issue was reported to the curl project on August 26, 2026.
curl 8.23.0 was released on October 14, 2026, coordinated with the publication of this advisory.
CREDITS
- Reported-by: Stanislav Fort (Aisle Research)
- Patched-by: Daniel Stenberg
Thanks a lot!