Unscored severity · published Oct 20, 2026
CVE-2026-87863
HSTS response erases persisted entries
–
CVSS
0.3%
EPSS
No
On KEV
Description
An authenticated HTTPS origin can supply an HSTS `max-age` value that the
parser accepts, but time serialization later fails to process. On 64-bit
systems, extreme max-age values compute an absolute expiry within standard
time integer limits that exceeds calendar time structure bounds. During cache
saves, the original HSTS file is truncated before writing a temporary
replacement; when serialization fails, the temporary file is deleted, leaving
an empty or partial cache. Because the save error is silently ignored during
cleanup, curl exits successfully despite the data loss.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CU
curl · curl
8.22.0 through 8.22.0; 8.21.0 through 8.21.0; 8.20.0 through 8.20.0; 8.19.0 through 8.19.0; 8.18.0 through 8.18.0; 8.17.0 through 8.17.0; +22 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-87863
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-87863
curl.se
https://curl.se/docs/CVE-2026-87863.html
curl.se
https://curl.se/docs/CVE-2026-87863.json
hackerone.com
https://hackerone.com/reports/3972373
More from curl
9.8
CVE-2026-19931
Negotiate ambient user conn reuse
9.8
CVE-2026-9079
stale proxy password leak
9.8
CVE-2026-8925
SASL double-free
9.8
CVE-2026-11856
cross-origin Digest auth state leak
9.8
CVE-2026-10536
HTTP/2 stream-dependency tree UAF
