UBUNTU-CVE-2026-87862

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-87862

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-87862.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-87862

Upstream

CVE-2026-87862

Downstream

USN (2)

Related

USN-8927-1

Published

2026-10-14T06:00:00Z

Modified

2026-10-17T13:01:14Z

Severity

Ubuntu - low

Summary

[none]

Details

Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.

References

Affected packages

Ubuntu:22.04:LTS / curl

Package

Name: curl
Purl: pkg:deb/ubuntu/curl?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

7.*

7.74.0-1.3ubuntu2

7.74.0-1.3ubuntu3

7.80.0-3

7.81.0-1

7.81.0-1ubuntu1.1

7.81.0-1ubuntu1.2

7.81.0-1ubuntu1.3

7.81.0-1ubuntu1.4

7.81.0-1ubuntu1.6

7.81.0-1ubuntu1.7

7.81.0-1ubuntu1.8

7.81.0-1ubuntu1.10

7.81.0-1ubuntu1.11

7.81.0-1ubuntu1.13

7.81.0-1ubuntu1.14

7.81.0-1ubuntu1.15

7.81.0-1ubuntu1.16

7.81.0-1ubuntu1.17

7.81.0-1ubuntu1.18

7.81.0-1ubuntu1.19

7.81.0-1ubuntu1.20

7.81.0-1ubuntu1.21

7.81.0-1ubuntu1.22

7.81.0-1ubuntu1.23

7.81.0-1ubuntu1.24

7.81.0-1ubuntu1.25

7.81.0-1ubuntu1.26

7.81.0-1ubuntu1.27

7.81.0-1ubuntu1.29

7.81.0-1ubuntu1.30

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "curl",
            "binary_version":  "7.81.0-1ubuntu1.30"
        },
        {
            "binary_name":  "libcurl3-gnutls",
            "binary_version":  "7.81.0-1ubuntu1.30"
        },
        {
            "binary_name":  "libcurl3-nss",
            "binary_version":  "7.81.0-1ubuntu1.30"
        },
        {
            "binary_name":  "libcurl4",
            "binary_version":  "7.81.0-1ubuntu1.30"
        }
    ],
    "priority_reason":  "Upstream defined this as low severity"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-87862.json"

Ubuntu:24.04:LTS / curl

Package

Name: curl
Purl: pkg:deb/ubuntu/curl?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

8.*

8.2.1-1ubuntu3

8.2.1-1ubuntu3.1

8.4.0-2ubuntu1

8.5.0-2ubuntu1

8.5.0-2ubuntu2

8.5.0-2ubuntu8

8.5.0-2ubuntu9

8.5.0-2ubuntu10

8.5.0-2ubuntu10.1

8.5.0-2ubuntu10.2

8.5.0-2ubuntu10.3

8.5.0-2ubuntu10.4

8.5.0-2ubuntu10.5

8.5.0-2ubuntu10.6

8.5.0-2ubuntu10.7

8.5.0-2ubuntu10.8

8.5.0-2ubuntu10.9

8.5.0-2ubuntu10.10

8.5.0-2ubuntu10.11

8.5.0-2ubuntu10.12

8.5.0-2ubuntu10.13

8.5.0-2ubuntu10.15

8.5.0-2ubuntu10.16

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "curl",
            "binary_version":  "8.5.0-2ubuntu10.16"
        },
        {
            "binary_name":  "libcurl3t64-gnutls",
            "binary_version":  "8.5.0-2ubuntu10.16"
        },
        {
            "binary_name":  "libcurl4t64",
            "binary_version":  "8.5.0-2ubuntu10.16"
        }
    ],
    "priority_reason":  "Upstream defined this as low severity"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-87862.json"

Ubuntu:26.10 / curl

Package

Name: curl
Purl: pkg:deb/ubuntu/curl?arch=source&distro=stonking

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

8.*

8.18.0-1ubuntu2

8.20.0-2ubuntu1

8.20.0-2ubuntu3

8.20.0-2ubuntu10

8.20.0-2ubuntu11

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "curl",
            "binary_version":  "8.20.0-2ubuntu11"
        },
        {
            "binary_name":  "libcurl3t64-gnutls",
            "binary_version":  "8.20.0-2ubuntu11"
        },
        {
            "binary_name":  "libcurl4t64",
            "binary_version":  "8.20.0-2ubuntu11"
        }
    ],
    "priority_reason":  "Upstream defined this as low severity"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-87862.json"

Ubuntu:26.04:LTS / curl

Package

Name: curl
Purl: pkg:deb/ubuntu/curl?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

8.18.0-1ubuntu2.8

Affected versions

8.*

8.14.1-2ubuntu1

8.17.0-1ubuntu1

8.18.0-1ubuntu1

8.18.0-1ubuntu2

8.18.0-1ubuntu2.1

8.18.0-1ubuntu2.2

8.18.0-1ubuntu2.3

8.18.0-1ubuntu2.4

8.18.0-1ubuntu2.5

8.18.0-1ubuntu2.7

Ecosystem specific

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "curl",
            "binary_version":  "8.18.0-1ubuntu2.8"
        },
        {
            "binary_name":  "libcurl3t64-gnutls",
            "binary_version":  "8.18.0-1ubuntu2.8"
        },
        {
            "binary_name":  "libcurl4t64",
            "binary_version":  "8.18.0-1ubuntu2.8"
        }
    ],
    "priority_reason":  "Upstream defined this as low severity"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-87862.json"