CVE-2026-87862: HSTS cache import drops longer-lived child
Published Oct 20, 2026
·Updated
Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.
Affected Software
1 affected componentFixes available
debian/curl<=8.14.1-2+deb13u5, <=8.14.1-2+deb13u7, <=8.22.0-1
7.88.1-10+deb12u157.88.1-10+deb12u58.23.0-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.88.1-10+deb12u15Fixed in 7.88.1-10+deb12u5Fixed in 8.23.0-1
Event History
Oct 14, 2026
CVE Published
via Ubuntu·09:52 PM
Data Sourced
via Ubuntu·09:52 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·09:53 PM
DescriptionAffected Software
Oct 20, 2026
CVE Published
via MITRE·08:10 PM
Data Sourced
via MITRE·08:10 PM
DescriptionWeakness
Data Sourced
via NVD·09:17 PM
Description