AZL-110307

See a problem?
Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-110307.json
JSON Data
https://api.osv.dev/v1/vulns/AZL-110307
Upstream
  • CVE-2026-87863
Published
2026-10-20T21:17:20Z
Modified
2026-10-27T05:36:16Z
Summary
CVE-2026-87863 affecting package tensorflow 2.16.1-11
Details

An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.

References

Affected packages

Azure Linux:3 / tensorflow

Package

Name
tensorflow
Purl
pkg:rpm/azure-linux/tensorflow

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
2.16.1-11

Database specific

source
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-110307.json"