HSTS response erases persisted entries
======================================

Project curl Security Advisory, October 14 2026
[Permalink](https://curl.se/docs/CVE-2026-87863.html)

VULNERABILITY
-------------

An authenticated HTTPS origin can supply an HSTS `max-age` value that the
parser accepts, but time serialization later fails to process. On 64-bit
systems, extreme max-age values compute an absolute expiry within standard
time integer limits that exceeds calendar time structure bounds. During cache
saves, the original HSTS file is truncated before writing a temporary
replacement; when serialization fails, the temporary file is deleted, leaving
an empty or partial cache. Because the save error is silently ignored during
cleanup, curl exits successfully despite the data loss.

INFO
----

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-87863 to this issue.

CWE-201: Information Exposure Through Sent Data

Severity: Low

AFFECTED VERSIONS
-----------------

- Affected versions: curl 8.2.0 to and including 8.22.0
- Not affected versions: curl < 8.2.0 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/0c667188e0c6cda615a036b8a

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION
------------

- Fixed-in: https://github.com/curl/curl/commit/08d50a791b3197a3d0a4fc2f778e24

RECOMMENDATIONS
--------------

 A - Upgrade curl to version 8.23.0

 B - Apply the patch to your local version

 C - Do not rely on HSTS

TIMELINE
--------

This issue was reported to the curl project on August 26, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Stanislav Fort (Aisle Research)
- Patched-by: Daniel Stenberg

Thanks a lot!