---
id: CVE-2026-87862
title: HSTS cache import drops longer-lived child
summary: |-
  Importing a `includeSubDomains` parent HSTS entry before a longer-lived child
  entry, silently drops the child. Consequently, when the parent expires, the
  child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP
  requests …
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-201
vendor: curl
product: curl
affected:
  - curl >= 8.22.0 <= 8.22.0
  - curl >= 8.21.0 <= 8.21.0
  - curl >= 8.20.0 <= 8.20.0
  - curl >= 8.19.0 <= 8.19.0
  - curl >= 8.18.0 <= 8.18.0
  - curl >= 8.17.0 <= 8.17.0
  - curl >= 8.16.0 <= 8.16.0
  - curl >= 8.15.0 <= 8.15.0
  - curl >= 8.14.1 <= 8.14.1
  - curl >= 8.14.0 <= 8.14.0
  - curl >= 8.13.0 <= 8.13.0
  - curl >= 8.12.1 <= 8.12.1
  - curl >= 8.12.0 <= 8.12.0
  - curl >= 8.11.1 <= 8.11.1
  - curl >= 8.11.0 <= 8.11.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-30T11:57:38.044240Z'
exploitAvailable: true
published: '2026-10-20'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T11:57:49.186Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-87862'
references:
  - url: 'https://curl.se/docs/CVE-2026-87862.json'
    label: json
  - url: 'https://curl.se/docs/CVE-2026-87862.html'
    label: www
  - url: 'https://hackerone.com/reports/3972357'
    label: issue
tags:
  - cve.org
  - exploit-available
epss: 0.00995
epssPercentile: 0.62671
ingestedAt: '2026-10-20T21:19:21.286Z'
---

## Overview

Importing a `includeSubDomains` parent HSTS entry before a longer-lived child
entry, silently drops the child. Consequently, when the parent expires, the
child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP
requests rather than upgrading to HTTPS.

## Affected

- `curl >= 8.22.0 <= 8.22.0`
- `curl >= 8.21.0 <= 8.21.0`
- `curl >= 8.20.0 <= 8.20.0`
- `curl >= 8.19.0 <= 8.19.0`
- `curl >= 8.18.0 <= 8.18.0`
- `curl >= 8.17.0 <= 8.17.0`
- `curl >= 8.16.0 <= 8.16.0`
- `curl >= 8.15.0 <= 8.15.0`
- `curl >= 8.14.1 <= 8.14.1`
- `curl >= 8.14.0 <= 8.14.0`
- `curl >= 8.13.0 <= 8.13.0`
- `curl >= 8.12.1 <= 8.12.1`
- `curl >= 8.12.0 <= 8.12.0`
- `curl >= 8.11.1 <= 8.11.1`
- `curl >= 8.11.0 <= 8.11.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.