AZL-109971

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-109971.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-109971

Upstream

CVE-2026-87862

Published

2026-10-20T21:17:20Z

Modified

2026-10-28T05:32:34Z

Summary

CVE-2026-87862 affecting package curl 8.11.1-11

Details

Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-87862

Affected packages

Azure Linux:3 / curl

Package

Name: curl
Purl: pkg:rpm/azure-linux/curl

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

8.11.1-11

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-109971.json"