CVE-2026-87863

An authenticated HTTPS origin can supply an HSTS `max-age` value that the

parser accepts, but time serialization later fails to process. On 64-bit

systems, extreme max-age values compute an absolute expiry within standard

time integer limits that exceeds calendar time structure bounds. During cache

saves, the original HSTS file is truncated before writing a temporary

replacement; when serialization fails, the temporary file is deleted, leaving

an empty or partial cache. Because the save error is silently ignored during

cleanup, curl exits successfully despite the data loss.