CVE-2026-87863
HSTS response erases persisted entries
Project curl Security Advisory, October 14 2026 Permalink
VULNERABILITY
An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds.
During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.
INFO
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-87863 to this issue.
CWE-201: Information Exposure Through Sent Data
Severity: Low
AFFECTED VERSIONS
- Affected versions: curl 8.2.0 to and including 8.22.0
- Not affected versions: curl < 8.2.0 and >= 8.23.0
- Not affected versions: curl >= 8.20.2 in the 8.20.X branch
- Not affected versions: curl >= 8.16.2 in the 8.16.X branch
- Not affected versions: curl >= 8.14.3 in the 8.14.X branch
- Introduced-in: https://github.com/curl/curl/commit/0c667188e0c6cda615a036b8a
libcurl is used by many applications, but not always advertised as such!
This flaw also affects the curl command line tool.
SOLUTION
RECOMMENDATIONS
A - Upgrade curl to version 8.23.0
B - Apply the patch to your local version
C - Do not rely on HSTS
TIMELINE
This issue was reported to the curl project on August 26, 2026.
curl 8.23.0 was released on October 14, 2026, coordinated with the publication of this advisory.
CREDITS
- Reported-by: Stanislav Fort (Aisle Research)
- Patched-by: Daniel Stenberg
Thanks a lot!