CURL-CVE-2026-87862

See a problem?
Please try reporting it to the source first.
Source
https://curl.se/docs/CVE-2026-87862.html
Import Source
https://curl.se/docs/CURL-CVE-2026-87862.json
JSON Data
https://api.osv.dev/v1/vulns/CURL-CVE-2026-87862
Aliases
  • CVE-2026-87862
Published
2026-10-14T08:00:00Z
Modified
2026-10-14T19:02:56Z
Summary
HSTS cache import drops longer-lived child
Details

Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.

Database specific 
{
    "CWE":  {
        "desc":  "Information Exposure Through Sent Data",
        "id":  "CWE-201"
    },
    "URL":  "https://curl.se/docs/CVE-2026-87862.json",
    "affects":  "both",
    "issue":  "https://hackerone.com/reports/3972357",
    "last_affected":  "8.22.0",
    "package":  "curl",
    "severity":  "Low",
    "www":  "https://curl.se/docs/CVE-2026-87862.html"
}
Credits
    • Stanislav Fort (Aisle Research) - FINDER
    • Daniel Stenberg - REMEDIATION_DEVELOPER

Affected packages

Git / github.com/curl/curl.git

Affected ranges

Type
SEMVER
Events
Introduced
8.11.0
Fixed
8.14.3
Introduced
8.15.0
Fixed
8.16.2
Introduced
8.17.0
Fixed
8.20.2
Introduced
8.21.0
Fixed
8.23.0
Type
GIT
Repo
https://github.com/curl/curl.git
Events
Introduced
a94973805df96269bf3f3bf0a20ccb9887313316
Fixed
a1614c3bcf1593eb524b37792124357d97a5429c

Affected versions

8.*
8.11.0
8.11.1
8.12.0
8.12.1
8.13.0
8.14.0
8.14.1
8.15.0
8.16.0
8.17.0
8.18.0
8.19.0
8.20.0
8.21.0
8.22.0
Other
curl-8_11_0
curl-8_11_1
curl-8_12_0
curl-8_12_1
curl-8_13_0
curl-8_14_0
curl-8_14_1
curl-8_15_0
curl-8_16_0
curl-8_17_0
curl-8_18_0
curl-8_19_0
curl-8_20_0
curl-8_21_0
curl-8_22_0
rc-8_18_0-1
rc-8_18_0-2
rc-8_18_0-3
rc-8_19_0-1
rc-8_19_0-2
rc-8_19_0-3
rc-8_20_0-1
rc-8_20_0-2
rc-8_20_0-3
rc-8_21_0-1
rc-8_21_0-2
rc-8_21_0-3
rc-8_22_0-1
rc-8_22_0-2
rc-8_22_0-3

Database specific

source 
"https://curl.se/docs/CURL-CVE-2026-87862.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "224427400684326249590822012963350597075",
                "2737065825097435213544451821822622621",
                "214650631889071362966467564430717118548",
                "116082283867178258548291069737951800414"
            ],
            "threshold":  0.9
        },
        "id":  "CURL-CVE-2026-87862-9ffd2bf3",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/a1614c3bcf1593eb524b37792124357d97a5429c",
        "target":  {
            "file":  "lib/hsts.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "256221136634413402692360369980878541334",
            "length":  966
        },
        "id":  "CURL-CVE-2026-87862-c6e9f2fa",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/a1614c3bcf1593eb524b37792124357d97a5429c",
        "target":  {
            "file":  "lib/hsts.c",
            "function":  "hsts_add_host_expire"
        }
    }
]
vanir_signatures_modified 
"2026-10-14T19:02:56Z"