CVE-2026-87862

Published: Ott 20, 2026 Last Modified: Ott 20, 2026
ExploitDB:
Other exploit source:
Google Dorks:

Description

AI Translation Available

Importing a `includeSubDomains` parent HSTS entry before a longer-lived child
entry, silently drops the child. Consequently, when the parent expires, the
child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP
requests rather than upgrading to HTTPS.

https://curl.se/docs/CVE-2026-87862.html
https://curl.se/docs/CVE-2026-87862.html
https://curl.se/docs/CVE-2026-87862.json
https://curl.se/docs/CVE-2026-87862.json
https://hackerone.com/reports/3972357
https://hackerone.com/reports/3972357