---
id: "CVE-2026-87862"
kind: "vulnerability"
aliases: ["CVE-2026-87862"]
title: "curl: HSTS import drops longer-lived child entries, allowing plaintext HTTP requests"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cli", "curl", "package", "scripts"]
not_affected_if: ["default-config", "no-hsts-file"]
published_at: "2026-10-20T21:17:20+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T05:04:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87862", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# curl: HSTS import drops longer-lived child entries, allowing plaintext HTTP requests

When curl imports an HSTS file where a parent domain with includeSubDomains comes before a longer-lived child entry, the child entry is silently discarded. After the parent expires, curl sends plain HTTP requests to the child host instead of upgrading to HTTPS.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87862

## From the sources

Importing a `includeSubDomains` parent HSTS entry before a longer-lived child
entry, silently drops the child. Consequently, when the parent expires, the
child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP
requests rather than upgrading to HTTPS.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_