Vulnerability · Published Oct 20, 2026 · Assigned by curl
CVE-2026-87863HSTS response erases persisted entries
High 8.1
In plain English
A high-severity security flaw in curl from curl. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | curl | 8.23.0-r0 | ALPINE-CVE-2026-87863 |
| Alpine:v3.24 | curl | 8.23.0-r0 | ALPINE-CVE-2026-87863 |
| Debian:13 | curl | no fix listed | DEBIAN-CVE-2026-87863 |
| Debian:14 | curl | no fix listed | DEBIAN-CVE-2026-87863 |
| Ubuntu:22.04:LTS | curl | 7.81.0-1ubuntu1.30 | USN-8932-1 |
| Ubuntu:24.04:LTS | curl | 8.5.0-2ubuntu10.16 | UBUNTU-CVE-2026-87863 |
| Ubuntu:24.04:LTS | curl | 8.5.0-2ubuntu10.16 | USN-8932-1 |
| Ubuntu:26.04:LTS | curl | 8.18.0-1ubuntu2.8 | USN-8927-1 |
| Ubuntu:26.04:LTS | curl | 8.18.0-1ubuntu2.8 | UBUNTU-CVE-2026-87863 |
| Ubuntu:26.10 | curl | 8.20.0-2ubuntu11.1 | USN-8927-2 |
| Ubuntu:26.10 | curl | 8.20.0-2ubuntu11.1 | UBUNTU-CVE-2026-87863 |
Affected products (as reported)
Weakness: CWE-201 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H