CVEvulnerability
CVE-2026-87862
- Status
- Awaiting Analysis
- Published
- 2026-10-20
- Last modified
- 2026-10-22
- Assigner
- 2499f714-1537-4658-8207-48ae4bb9eae9
Description
Importing a `includeSubDomains` parent HSTS entry before a longer-lived child
entry, silently drops the child. Consequently, when the parent expires, the
child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP
requests rather than upgrading to HTTPS.
References
- https://curl.se/docs/CVE-2026-87862.html curl.se
- https://curl.se/docs/CVE-2026-87862.json curl.se
- https://hackerone.com/reports/3972357 hackerone.com