CVE-2026-87863
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
HSTS response erases persisted entries
An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
curl
- Vendor
- curl
- Product
- curl
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 8.22.0 | affected | semver | Unavailable | 8.22.0 | None listed |
| 8.21.0 | affected | semver | Unavailable | 8.21.0 | None listed |
| 8.20.0 | affected | semver | Unavailable | 8.20.0 | None listed |
| 8.19.0 | affected | semver | Unavailable | 8.19.0 | None listed |
| 8.18.0 | affected | semver | Unavailable | 8.18.0 | None listed |
| 8.17.0 | affected | semver | Unavailable | 8.17.0 | None listed |
| 8.16.0 | affected | semver | Unavailable | 8.16.0 | None listed |
| 8.15.0 | affected | semver | Unavailable | 8.15.0 | None listed |
| 8.14.1 | affected | semver | Unavailable | 8.14.1 | None listed |
| 8.14.0 | affected | semver | Unavailable | 8.14.0 | None listed |
| 8.13.0 | affected | semver | Unavailable | 8.13.0 | None listed |
| 8.12.1 | affected | semver | Unavailable | 8.12.1 | None listed |
| 8.12.0 | affected | semver | Unavailable | 8.12.0 | None listed |
| 8.11.1 | affected | semver | Unavailable | 8.11.1 | None listed |
| 8.11.0 | affected | semver | Unavailable | 8.11.0 | None listed |
| 8.10.1 | affected | semver | Unavailable | 8.10.1 | None listed |
| 8.10.0 | affected | semver | Unavailable | 8.10.0 | None listed |
| 8.9.1 | affected | semver | Unavailable | 8.9.1 | None listed |
| 8.9.0 | affected | semver | Unavailable | 8.9.0 | None listed |
| 8.8.0 | affected | semver | Unavailable | 8.8.0 | None listed |
| 8.7.1 | affected | semver | Unavailable | 8.7.1 | None listed |
| 8.7.0 | affected | semver | Unavailable | 8.7.0 | None listed |
| 8.6.0 | affected | semver | Unavailable | 8.6.0 | None listed |
| 8.5.0 | affected | semver | Unavailable | 8.5.0 | None listed |
| 8.4.0 | affected | semver | Unavailable | 8.4.0 | None listed |
| 8.3.0 | affected | semver | Unavailable | 8.3.0 | None listed |
| 8.2.1 | affected | semver | Unavailable | 8.2.1 | None listed |
| 8.2.0 | affected | semver | Unavailable | 8.2.0 | None listed |