Live › vulnerability › CVE-2026-87862
Go to dashboardWhen curl imports an HSTS file where a parent domain with includeSubDomains comes before a longer-lived child entry, the child entry is silently discarded. After the parent expires, curl sends plain HTTP requests to the child host instead of upgrading to HTTPS.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run curl with an HSTS cache file (--hsts) that is loaded from or built with imported entries, where a parent domain uses includeSubDomains and a subdomain has a longer max-age. Command-line or scripted curl that does not use an HSTS file is not affected by this import path. unknown for exact affected versions in the sources.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Importing a includeSubDomains parent HSTS entry before a longer-lived child
entry, silently drops the child. Consequently, when the parent expires, the
child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP
requests rather than upgrading to HTTPS.
This page as .md · .json · in your agent: get_signal("CVE-2026-87862")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.