{"id":"CVE-2026-87863","kind":"vulnerability","aliases":["CVE-2026-87863"],"related":[],"title":"curl: extreme HSTS max-age silently wipes the HSTS cache file","description":"An authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss.","summary":"An HTTPS server the client has already authenticated to can send an HSTS max-age so large that curl's time serialization fails when saving the HSTS cache. curl then truncates the cache file and deletes the replacement, leaving the HSTS cache empty or partial while still reporting success.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["curl","linux","package","self-hosted","windows"],"not_affected_if":["default-config","no-hsts-cache"],"how_to_check":"- Run `curl --version` and compare the curl version against the fixed release in the advisory.\n- Check whether the HSTS cache is in use by looking for a file set with `--hsts` or the default curl HSTS cache location on the host.","fix":"- Upgrade curl to a release that fixes CVE-2026-87863; the fixed version is unknown from the sources.","status":"open","published_at":"2026-10-20T21:17:20+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T05:04:28+00:00","updated_at":"2026-10-25T05:04:28+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:04:28Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade curl to a release that fixes CVE-2026-87863; the fixed version is unknown from the sources.","reach":"network","title":"curl: extreme HSTS max-age silently wipes the HSTS cache file","impact":"low","summary":"An HTTPS server the client has already authenticated to can send an HSTS max-age so large that curl's time serialization fails when saving the HSTS cache. curl then truncates the cache file and deletes the replacement, leaving the HSTS cache empty or partial while still reporting success.","category":"package","nicknames":[],"who_cares":["curl","self-hosted","linux","windows"],"confidence":0.5,"needs_auth":"yes","worst_case":"HSTS cache file emptied, silently losing stored HSTS entries","analyst_note":"Confirm the fixed curl version and the affected version range from the NVD entry or the curl project advisory.","how_to_check":"- Run `curl --version` and compare the curl version against the fixed release in the advisory.\n- Check whether the HSTS cache is in use by looking for a file set with `--hsts` or the default curl HSTS cache location on the host.","needs_analyst":true,"not_affected_if":["default-config","no-hsts-cache"],"who_is_affected":"Teams whose scripts or services run curl with HSTS caching enabled against HTTPS origins they already authenticate to. The sources say the risk is data loss in the HSTS cache, not code execution, so systems that do not use an HSTS cache file are unlikely to be affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000619,"input_tokens":3400,"output_tokens":558,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-87863':15A,18A '64':100C 'absolut':110C 'accept':91C 'age':6A,41B,86C,106C 'alreadi':32B 'authent':33B,77C 'bit':101C 'bound':122C 'cach':11A,54B,59B,68B,124C,150C 'calendar':119C 'cleanup':159C 'client':30B 'comput':108C 'curl':1A,19B,45B,55B,160C 'cve':13A,16A 'data':165C 'delet':62B,144C 'despit':163C 'empti':69B,147C 'error':154C 'exceed':118C 'exit':161C 'expiri':111C 'extrem':2A,103C 'fail':49B,96C,139C 'file':12A,60B,129C,142C 'host':24B 'hsts':3A,10A,38B,53B,67B,83C,128C 'https':27B,78C 'ignor':157C 'integ':115C 'larg':43B 'later':95C 'leav':65B,145C 'limit':116C 'linux':20B 'loss':166C 'max':5A,40B,85C,105C 'max-ag':4A,39B,84C,104C 'origin':79C,127C 'packag':21B 'parser':90C 'partial':71B,149C 'process':98C 'replac':64B,136C 'report':74B 'save':51B,125C,153C 'self':23B 'self-host':22B 'send':36B 'serial':48B,94C,138C 'server':28B 'silent':7A,156C 'standard':113C 'still':73B 'structur':121C 'success':75B,162C 'suppli':81C 'system':102C 'temporari':135C,141C 'time':47B,93C,114C,120C 'truncat':57B,131C 'valu':87C,107C 'window':25B 'wipe':8A 'within':112C 'write':133C","nicknames":[],"mitigations":[],"who_affected":"Teams whose scripts or services run curl with HSTS caching enabled against HTTPS origins they already authenticate to. The sources say the risk is data loss in the HSTS cache, not code execution, so systems that do not use an HSTS cache file are unlikely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87863","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87863","severity":null,"published_at":"2026-10-20T21:17:20+00:00","modified_at":"2026-10-22T17:21:57+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}