HSTS cache import drops longer-lived child
==========================================

Project curl Security Advisory, October 14 2026
[Permalink](https://curl.se/docs/CVE-2026-87862.html)

VULNERABILITY
-------------

Importing a `includeSubDomains` parent HSTS entry before a longer-lived child
entry, silently drops the child. Consequently, when the parent expires, the
child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP
requests rather than upgrading to HTTPS.

INFO
----

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-87862 to this issue.

CWE-201: Information Exposure Through Sent Data

Severity: Low

AFFECTED VERSIONS
-----------------

- Affected versions: curl 8.11.0 to and including 8.22.0
- Not affected versions: curl < 8.11.0 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/a94973805df96269bf3f3bf0a2

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION
------------

- Fixed-in: https://github.com/curl/curl/commit/a1614c3bcf1593eb524b37792124357

RECOMMENDATIONS
--------------

 A - Upgrade curl to version 8.23.0

 B - Apply the patch to your local version

 C - Do not rely on HSTS

TIMELINE
--------

This issue was reported to the curl project on August 26, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Stanislav Fort (Aisle Research)
- Patched-by: Daniel Stenberg

Thanks a lot!