Skip to content
Heist/ feed
Unrated

HSTS response erases persisted entries

Type: advisorySource: Official CVE List1 source record

An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.

Announced Source revision 1
Original source ↗

CVE-2026-87863

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-87863

curl

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "curl",
    "product": "curl",
    "versions": [
      {
        "status": "affected",
        "version": "8.22.0",
        "versionType": "semver",
        "lessThanOrEqual": "8.22.0"
      },
      {
        "status": "affected",
        "version": "8.21.0",
        "versionType": "semver",
        "lessThanOrEqual": "8.21.0"
      },
      {
        "status": "affected",
        "version": "8.20.0",
        "versionType": "semver",
        "lessThanOrEqual": "8.20.0"
      },
      {
        "status": "affected",
        "version": "8.19.0",
        "versionType": "semver",
        "lessThanOrEqual": "8.19.0"
      },
      {
        "status": "affected",
        "version": "8.18.0",
        "versionType": "semver",
        "lessThanOrEqual": "8.18.0"
      },
      {
        "status": "affected",
        "version": "8.17.0",
        "versionType": "semver",
        "lessThanOrEqual": "8.17.0"
      },
      {
        "status": "affected",
        "version": "8.16.0",
        "versionType": "semver",
        "lessThanOrEqual": "8.16.0"
      },
      {
        "status": "affected",
        "version": "8.15.0",
        "versionType": "semver",
        "lessThanOrEqual": "8.15.0"
      },
      {
        "status": "affected",
        "version": "8.14.1",
        "versionType": "semver",
        "lessThanOrEqual": "8.14.1"
      },
      {
        "status": "affected",
        "version": "8.14.0",
        "versionType": "semver",
        "lessThanOrEqual": "8.14.0"
      },
      {
        "status": "affected",
        "version": "8.13.0",
        "versionType": "semver",
        "lessThanOrEqual": "8.13.0"
      },
      {
        "status": "affected",
        "version": "8.12.1",
        "versionType": "semver",
        "lessThanOrEqual": "8.12.1"
      },
      {
        "status": "affected",
        "version": "8.12.0",
        "versionType": "semver",
        "lessThanOrEqual": "8.12.0"
      },
      {
        "status": "affected",
        "version": "8.11.1",
        "versionType": "semver",
        "lessThanOrEqual": "8.11.1"
      },
      {
        "status": "affected",
        "version": "8.11.0",
        "versionType": "semver",
        "lessThanOrEqual": "8.11.0"
      },
      {
        "status": "affected",
        "version": "8.10.1",
        "versionType": "semver",
        "lessThanOrEqual": "8.10.1"
      },
      {
        "status": "affected",
        "version": "8.10.0",
        "versionType": "semver",
        "lessThanOrEqual": "8.10.0"
      },
      {
        "status": "affected",
        "version": "8.9.1",
        "versionType": "semver",
        "lessThanOrEqual": "8.9.1"
      },
      {
        "status": "affected",
        "version": "8.9.0",
        "versionType": "semver",
        "lessThanOrEqual": "8.9.0"
      },
      {
        "status": "affected",
        "version": "8.8.0",
        "versionType": "semver",
        "lessThanOrEqual": "8.8.0"
      },
      {
        "status": "affected",
        "version": "8.7.1",
        "versionType": "semver",
        "lessThanOrEqual": "8.7.1"
      },
      {
        "status": "affected",
        "version": "8.7.0",
        "versionType": "semver",
        "lessThanOrEqual": "8.7.0"
      },
      {
        "status": "affected",
        "version": "8.6.0",
        "versionType": "semver",
        "lessThanOrEqual": "8.6.0"
      },
      {
        "status": "affected",
        "version": "8.5.0",
        "versionType": "semver",
        "lessThanOrEqual": "8.5.0"
      },
      {
        "status": "affected",
        "version": "8.4.0",
        "versionType": "semver",
        "lessThanOrEqual": "8.4.0"
      },
      {
        "status": "affected",
        "version": "8.3.0",
        "versionType": "semver",
        "lessThanOrEqual": "8.3.0"
      },
      {
        "status": "affected",
        "version": "8.2.1",
        "versionType": "semver",
        "lessThanOrEqual": "8.2.1"
      },
      {
        "status": "affected",
        "version": "8.2.0",
        "versionType": "semver",
        "lessThanOrEqual": "8.2.0"
      }
    ],
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-87863

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#42606 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement