CVE-2026-87862

CVE-2026-87862

published October 21, 2026

CVSS
—
EPSS
0%
Percentile
20.5
In the wild
Unconfirmed
What it is

Importing a `includeSubDomains` parent HSTS entry before a longer-lived child

entry, silently drops the child. Consequently, when the parent expires, the

child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP

requests rather than upgrading to HTTPS.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00291 · 20.5th percentile
Published
2026-10-21T01:17Z
References (3)
https://curl.se/docs/CVE-2026-87862.html · 2499f714-1537-4658-8207-48ae4bb9eae9https://curl.se/docs/CVE-2026-87862.json · 2499f714-1537-4658-8207-48ae4bb9eae9https://hackerone.com/reports/3972357 · 2499f714-1537-4658-8207-48ae4bb9eae9
EPSS history
Timeline
  • 22 OCT 03:36Z
    EPSS moved — → 0%
    epss
  • 20 OCT 20:10Z
    HSTS cache import drops longer-lived child
    cvelistv5
  • 20 OCT 20:10Z
    HSTS cache import drops longer-lived child
    cvelistv5