---
id: "CVE-2026-87863"
kind: "vulnerability"
aliases: ["CVE-2026-87863"]
title: "curl: extreme HSTS max-age silently wipes the HSTS cache file"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["curl", "linux", "package", "self-hosted", "windows"]
not_affected_if: ["default-config", "no-hsts-cache"]
published_at: "2026-10-20T21:17:20+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T05:04:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87863", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# curl: extreme HSTS max-age silently wipes the HSTS cache file

An HTTPS server the client has already authenticated to can send an HSTS max-age so large that curl's time serialization fails when saving the HSTS cache. curl then truncates the cache file and deletes the replacement, leaving the HSTS cache empty or partial while still reporting success.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `curl --version` and compare the curl version against the fixed release in the advisory.
- Check whether the HSTS cache is in use by looking for a file set with `--hsts` or the default curl HSTS cache location on the host.

## Fix

- Upgrade curl to a release that fixes CVE-2026-87863; the fixed version is unknown from the sources.

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87863

## From the sources

An authenticated HTTPS origin can supply an HSTS `max-age` value that the
parser accepts, but time serialization later fails to process. On 64-bit
systems, extreme max-age values compute an absolute expiry within standard
time integer limits that exceeds calendar time structure bounds. During cache
saves, the original HSTS file is truncated before writing a temporary
replacement; when serialization fails, the temporary file is deleted, leaving
an empty or partial cache. Because the save error is silently ignored during
cleanup, curl exits successfully despite the data loss.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_