Bug 2550645 (CVE-2026-87863)

Summary:	CVE-2026-87863 curl: curl: Hsts Response Erases Persisted Entries
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	anthomas, csutherl, ehelms, ggainey, jclere, jpasqual, juwatts, mdellweg, mhulan, nmoumoul, osousa, pcreech, pjindal, plodge, rchan, rekumar, rhel-process-autobot, security-response-team, smallamp, szappis, tmalecek, vchlup, vvoronko, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in curl. When persistent HTTP Strict Transport Security (HSTS) caching is enabled, a remote HTTPS server can return an out-of-range expiration value that fails time serialization during cache saving. Because curl truncates the cache file prior to writing the update, this serialization failure causes the persistent HSTS cache to be deleted or emptied. As a result, stored security policies for known hosts are lost, potentially allowing future connections to fall back to insecure communication.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-10-14

Description OSIDB Bzimport 2026-10-13 15:49:56 UTC

HSTS response erases persisted entries
======================================

Project curl Security Advisory, October 14 2026
[Permalink](https://curl.se/docs/CVE-2026-87863.html)

VULNERABILITY
-------------

An authenticated HTTPS origin can supply an HSTS `max-age` value that the
parser accepts, but time serialization later fails to process. On 64-bit
systems, extreme max-age values compute an absolute expiry within standard
time integer limits that exceeds calendar time structure bounds. During cache
saves, the original HSTS file is truncated before writing a temporary
replacement; when serialization fails, the temporary file is deleted, leaving
an empty or partial cache. Because the save error is silently ignored during
cleanup, curl exits successfully despite the data loss.

INFO
----

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-87863 to this issue.

CWE-201: Information Exposure Through Sent Data

Severity: Low

AFFECTED VERSIONS
-----------------

- Affected versions: curl 8.2.0 to and including 8.22.0
- Not affected versions: curl < 8.2.0 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/0c667188e0c6cda615a036b8a

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION
------------

- Fixed-in: https://github.com/curl/curl/commit/08d50a791b3197a3d0a4fc2f778e24

RECOMMENDATIONS
--------------

 A - Upgrade curl to version 8.23.0

 B - Apply the patch to your local version

 C - Do not rely on HSTS

TIMELINE
--------

This issue was reported to the curl project on August 26, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Stanislav Fort (Aisle Research)
- Patched-by: Daniel Stenberg

Thanks a lot!