CVE-2026-87863

Name of the Vulnerable Software and Affected Versions curl (affected versions not specified)

Description An authenticated HTTPS origin can provide an HSTS max-age value that is accepted by the parser but fails during subsequent time serialization. On 64-bit systems, extreme max-age values can result in an absolute expiry that exceeds calendar time structure bounds while remaining within standard time integer limits. During the cache saving process, the original HSTS file is truncated before a temporary replacement is written. If serialization fails, the temporary file is deleted, resulting in an empty or partial cache. This data loss occurs silently, and the application exits successfully without indicating an error.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.