CVE-2026-87863
Description
AI Translation Available
An authenticated HTTPS origin can supply an HSTS `max-age` value that the
parser accepts, but time serialization later fails to process. On 64-bit
systems, extreme max-age values compute an absolute expiry within standard
time integer limits that exceeds calendar time structure bounds. During cache
saves, the original HSTS file is truncated before writing a temporary
replacement; when serialization fails, the temporary file is deleted, leaving
an empty or partial cache. Because the save error is silently ignored during
cleanup, curl exits successfully despite the data loss.
https://curl.se/docs/CVE-2026-87863.html
https://curl.se/docs/CVE-2026-87863.json
https://hackerone.com/reports/3972373