CVE-2026-87863: HSTS response erases persisted entries
An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/curlto a version that resolves this vulnerability.Fixed in 8.23.0-r0 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.88.1-10+deb12u15Fixed in 7.88.1-10+deb12u5Fixed in 8.23.0-1 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.5.0-2ubuntu10.16 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.20.0-2ubuntu11.1 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.18.0-1ubuntu2.8
Event History
Frequently Asked Questions
What conditions are required to trigger the cache loss?
An attacker-controlled or otherwise untrusted authenticated HTTPS origin must be able to send an HSTS header with an extreme max-age value that curl accepts. The issue applies on 64-bit systems when that value produces an expiry that is within the time integer range but cannot be represented by calendar time structures during cache serialization.
Which deployments are exposed to persistent HSTS state loss?
Deployments that use curl's persisted HSTS cache are exposed when they connect to an HTTPS origin capable of supplying the crafted HSTS value. The failure occurs while saving the cache: the existing HSTS file may already have been truncated before serialization fails.
How can operators tell whether this has occurred?
Inspect the persisted HSTS cache after curl accesses an untrusted authenticated HTTPS origin. An affected save can leave the cache empty or partially written, while curl may still exit successfully because the save error is ignored during cleanup.