CVE-2026-87862

Name of the Vulnerable Software and Affected Versions curl (affected versions not specified)

Description An issue exists during the HSTS cache import process where importing a parent HSTS entry with the includeSubDomains flag before a longer-lived child entry causes the child entry to be silently dropped. When the parent entry eventually expires, the valid HSTS policy for the child is lost, which leads the software to issue unencrypted HTTP requests instead of upgrading them to HTTPS.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.