CVE-2026-87862

Full vulnerability record from the local CVENow database.
Description

Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.
Severity
HIGH
CVSS score
8.1 (v3.1)
Vulnerability status
Awaiting Analysis
Source identifier
2499f714-1537-4658-8207-48ae4bb9eae9
Published
2026-10-20 21:17:20.270000
Last modified
2026-10-30 12:16:45.787000
View original CVE JSON
{
  "id": "CVE-2026-87862",
  "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9",
  "published": "2026-10-20T21:17:20.270",
  "lastModified": "2026-10-30T12:16:45.787",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild's valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS."
    }
  ],
  "affected": [
    {
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "affectedData": [
        {
          "vendor": "curl",
          "product": "curl",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "8.22.0",
              "lessThanOrEqual": "8.22.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.21.0",
              "lessThanOrEqual": "8.21.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.20.0",
              "lessThanOrEqual": "8.20.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.19.0",
              "lessThanOrEqual": "8.19.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.18.0",
              "lessThanOrEqual": "8.18.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.17.0",
              "lessThanOrEqual": "8.17.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.16.0",
              "lessThanOrEqual": "8.16.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.15.0",
              "lessThanOrEqual": "8.15.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.14.1",
              "lessThanOrEqual": "8.14.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.14.0",
              "lessThanOrEqual": "8.14.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.13.0",
              "lessThanOrEqual": "8.13.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.12.1",
              "lessThanOrEqual": "8.12.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.12.0",
              "lessThanOrEqual": "8.12.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.11.1",
              "lessThanOrEqual": "8.11.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.11.0",
              "lessThanOrEqual": "8.11.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-30T11:57:38.044240Z",
          "id": "CVE-2026-87862",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-201"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://curl.se/docs/CVE-2026-87862.html",
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9"
    },
    {
      "url": "https://curl.se/docs/CVE-2026-87862.json",
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9"
    },
    {
      "url": "https://hackerone.com/reports/3972357",
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9"
    },
    {
      "url": "https://hackerone.com/reports/3972357",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}