Unscored severity · published Oct 20, 2026
CVE-2026-87862
HSTS cache import drops longer-lived child
–
CVSS
0.3%
EPSS
No
On KEV
Description
Importing a `includeSubDomains` parent HSTS entry before a longer-lived child
entry, silently drops the child. Consequently, when the parent expires, the
child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP
requests rather than upgrading to HTTPS.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CU
curl · curl
8.22.0 through 8.22.0; 8.21.0 through 8.21.0; 8.20.0 through 8.20.0; 8.19.0 through 8.19.0; 8.18.0 through 8.18.0; 8.17.0 through 8.17.0; +9 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-87862
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-87862
curl.se
https://curl.se/docs/CVE-2026-87862.html
curl.se
https://curl.se/docs/CVE-2026-87862.json
hackerone.com
https://hackerone.com/reports/3972357
More from curl
9.8
CVE-2026-19931
Negotiate ambient user conn reuse
9.8
CVE-2026-9079
stale proxy password leak
9.8
CVE-2026-8925
SASL double-free
9.8
CVE-2026-11856
cross-origin Digest auth state leak
9.8
CVE-2026-10536
HTTP/2 stream-dependency tree UAF