CVE-2026-87863— HSTS response erases persisted entries
Quick assessment
Affected
curl curl
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
已认证的 HTTPS 源可以提供一个 HSTS 值，该值虽被解析器接受，但在后续的时间序列化过程中处理失败。在 64 位系统上，极端的 值计算出的绝对过期时间虽仍在标准时间整数范围内，却超出了日历时间结构（ 或相关结构体）的边界。在缓存保存过程中，原始 HSTS 文件会在写入临时替换文件之前被截断；当序列化失败时，临时文件会被删除，导致缓存变为空或部分缺失。由于在清理过程中保存错误被静默忽略，curl 即使发生了数据丢失，仍会成功退出。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-87863
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HSTS response erases persisted entries
Source: CVE Program / CVE List V5
Vulnerability Description
An authenticated HTTPS origin can supply an HSTS `max-age` value that the
parser accepts, but time serialization later fails to process. On 64-bit
systems, extreme max-age values compute an absolute expiry within standard
time integer limits that exceeds calendar time structure bounds. During cache
saves, the original HSTS file is truncated before writing a temporary
replacement; when serialization fails, the temporary file is deleted, leaving
an empty or partial cache. Because the save error is silently ignored during
cleanup, curl exits successfully despite the data loss.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-87863
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-87863
请登录查看更多情报信息。
Vendor Pages for CVE-2026-87863 (1)
Other References for CVE-2026-87863 (1)
Same Patch Batch · curl · 2026-10-20 · 23 CVEs total
| CVE-2026-92389 | TFTP direction confusion | |
| CVE-2026-107928 | info leak uploading over WebSockets with GnuTLS | |
| CVE-2026-107929 | local interface connection reuse mixup | |
| CVE-2026-94266 | password leak in CURLINFO_EFFECTIVE_URL | |
| CVE-2026-94265 | Authorization: Negotiate sent to foreign origin | |
| CVE-2026-86415 | auto client cert connection reuse mixup | |
| CVE-2026-86414 | leaking host credentials to HTTP proxy | |
| CVE-2026-92390 | -J no-clobber guarantee bypassed with 103 early hints | |
| CVE-2026-92387 | never-ending loop via server response omission | |
| CVE-2026-92388 | FTP wildcard write callback mixup | |
| CVE-2026-92386 | server-set cookie aborts cookie jar load | |
| CVE-2026-86409 | stale SigV4 headers sent unintended | |
| CVE-2026-92391 | curl_mime_free stack overflow by recursion | |
| CVE-2026-87865 | knownhost callback mismatches key as missing | |
| CVE-2026-87864 | IMAP APPEND plus CRLF conversion command injection | |
| CVE-2026-87866 | wolfSSL public-key pinning bypass | |
| CVE-2026-87861 | cross-origin reuse of a Negotiate connection | |
| CVE-2026-87862 | HSTS cache import drops longer-lived child | |
| CVE-2026-86411 | FTP connection reuse inherits client-certificate | |
| CVE-2026-86412 | server-set cookie erases cookie jar |
Showing top 20 of 23 CVEs. View all on vendor page → →