UnratedFix available
curl — security advisory
An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.
- Products
- curl
- Affected versions
- 8.14.1-2ubuntu1, 8.17.0-1ubuntu1, 8.18.0-1ubuntu1, 8.18.0-1ubuntu2, 8.18.0-1ubuntu2.1, 8.18.0-1ubuntu2.2, 8.18.0-1ubuntu2.3, 8.18.0-1ubuntu2.4, 8.18.0-1ubuntu2.5, 8.18.0-1ubuntu2.7, 8.2.1-1ubuntu3, 8.2.1-1ubuntu3.1, 8.20.0-2ubuntu1, 8.20.0-2ubuntu10, 8.20.0-2ubuntu11, 8.20.0-2ubuntu3, 8.4.0-2ubuntu1, 8.5.0-2ubuntu1, 8.5.0-2ubuntu10, 8.5.0-2ubuntu10.1, 8.5.0-2ubuntu10.10, 8.5.0-2ubuntu10.11, 8.5.0-2ubuntu10.12, 8.5.0-2ubuntu10.13, 8.5.0-2ubuntu10.15, 8.5.0-2ubuntu10.2, 8.5.0-2ubuntu10.3, 8.5.0-2ubuntu10.4, 8.5.0-2ubuntu10.5, 8.5.0-2ubuntu10.6, 8.5.0-2ubuntu10.7, 8.5.0-2ubuntu10.8, 8.5.0-2ubuntu10.9, 8.5.0-2ubuntu2, 8.5.0-2ubuntu8, 8.5.0-2ubuntu9
- Fixed versions
- 8.18.0-1ubuntu2.8, 8.20.0-2ubuntu11.1, 8.5.0-2ubuntu10.16
- CVEs
- CVE-2026-87863
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 13:26 UTC · Revision 1
Source evidence
An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.
osv:UBUNTU-CVE-2026-87863
curl
Fixed versions: 8.5.0-2ubuntu10.16
curl
Fixed versions: 8.20.0-2ubuntu11.1
curl
Fixed versions: 8.18.0-1ubuntu2.8
Complete source record
{
"id": "50f5fa157c82e241d2d34460c69eb54198b840f389cdb000fd64b85057fccd52",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-87863",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-87863",
"summary": "An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.",
"evidence": "osv:UBUNTU-CVE-2026-87863",
"products": [
{
"name": {
"value": "curl",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.5.0-2ubuntu10.16",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "8.2.1-1ubuntu3",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.1-1ubuntu3.1",
"evidence": "/affected/0/versions"
},
{
"value": "8.4.0-2ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.0-2ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.0-2ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.0-2ubuntu8",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.0-2ubuntu9",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.0-2ubuntu10",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.0-2ubuntu10.1",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.0-2ubuntu10.2",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.0-2ubuntu10.3",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.0-2ubuntu10.4",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.0-2ubuntu10.5",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.0-2ubuntu10.6",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.0-2ubuntu10.7",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.0-2ubuntu10.8",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.0-2ubuntu10.9",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.0-2ubuntu10.10",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.0-2ubuntu10.11",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.0-2ubuntu10.12",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.0-2ubuntu10.13",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.0-2ubuntu10.15",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "curl",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.20.0-2ubuntu11.1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "8.18.0-1ubuntu2",
"evidence": "/affected/1/versions"
},
{
"value": "8.20.0-2ubuntu1",
"evidence": "/affected/1/versions"
},
{
"value": "8.20.0-2ubuntu3",
"evidence": "/affected/1/versions"
},
{
"value": "8.20.0-2ubuntu10",
"evidence": "/affected/1/versions"
},
{
"value": "8.20.0-2ubuntu11",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "curl",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.18.0-1ubuntu2.8",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "8.14.1-2ubuntu1",
"evidence": "/affected/2/versions"
},
{
"value": "8.17.0-1ubuntu1",
"evidence": "/affected/2/versions"
},
{
"value": "8.18.0-1ubuntu1",
"evidence": "/affected/2/versions"
},
{
"value": "8.18.0-1ubuntu2",
"evidence": "/affected/2/versions"
},
{
"value": "8.18.0-1ubuntu2.1",
"evidence": "/affected/2/versions"
},
{
"value": "8.18.0-1ubuntu2.2",
"evidence": "/affected/2/versions"
},
{
"value": "8.18.0-1ubuntu2.3",
"evidence": "/affected/2/versions"
},
{
"value": "8.18.0-1ubuntu2.4",
"evidence": "/affected/2/versions"
},
{
"value": "8.18.0-1ubuntu2.5",
"evidence": "/affected/2/versions"
},
{
"value": "8.18.0-1ubuntu2.7",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "unknown",
"structured": {
"id": "UBUNTU-CVE-2026-87863",
"aliases": [
"UBUNTU-CVE-2026-87863"
],
"metrics": [
{
"type": "Ubuntu",
"score": "low"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.5.0-2ubuntu10.16"
}
]
}
],
"package": {
"name": "curl",
"purl": "pkg:deb/ubuntu/curl?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"8.2.1-1ubuntu3",
"8.2.1-1ubuntu3.1",
"8.4.0-2ubuntu1",
"8.5.0-2ubuntu1",
"8.5.0-2ubuntu2",
"8.5.0-2ubuntu8",
"8.5.0-2ubuntu9",
"8.5.0-2ubuntu10",
"8.5.0-2ubuntu10.1",
"8.5.0-2ubuntu10.2",
"8.5.0-2ubuntu10.3",
"8.5.0-2ubuntu10.4",
"8.5.0-2ubuntu10.5",
"8.5.0-2ubuntu10.6",
"8.5.0-2ubuntu10.7",
"8.5.0-2ubuntu10.8",
"8.5.0-2ubuntu10.9",
"8.5.0-2ubuntu10.10",
"8.5.0-2ubuntu10.11",
"8.5.0-2ubuntu10.12",
"8.5.0-2ubuntu10.13",
"8.5.0-2ubuntu10.15"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-87863.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "curl",
"binary_version": "8.5.0-2ubuntu10.16"
},
{
"binary_name": "libcurl3t64-gnutls",
"binary_version": "8.5.0-2ubuntu10.16"
},
{
"binary_name": "libcurl4t64",
"binary_version": "8.5.0-2ubuntu10.16"
}
],
"availability": "No subscription required",
"priority_reason": "Upstream defined this as low severity"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.20.0-2ubuntu11.1"
}
]
}
],
"package": {
"name": "curl",
"purl": "pkg:deb/ubuntu/curl?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"8.18.0-1ubuntu2",
"8.20.0-2ubuntu1",
"8.20.0-2ubuntu3",
"8.20.0-2ubuntu10",
"8.20.0-2ubuntu11"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-87863.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "curl",
"binary_version": "8.20.0-2ubuntu11.1"
},
{
"binary_name": "libcurl3t64-gnutls",
"binary_version": "8.20.0-2ubuntu11.1"
},
{
"binary_name": "libcurl4t64",
"binary_version": "8.20.0-2ubuntu11.1"
}
],
"availability": "No subscription required",
"priority_reason": "Upstream defined this as low severity"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.18.0-1ubuntu2.8"
}
]
}
],
"package": {
"name": "curl",
"purl": "pkg:deb/ubuntu/curl?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"8.14.1-2ubuntu1",
"8.17.0-1ubuntu1",
"8.18.0-1ubuntu1",
"8.18.0-1ubuntu2",
"8.18.0-1ubuntu2.1",
"8.18.0-1ubuntu2.2",
"8.18.0-1ubuntu2.3",
"8.18.0-1ubuntu2.4",
"8.18.0-1ubuntu2.5",
"8.18.0-1ubuntu2.7"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-87863.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "curl",
"binary_version": "8.18.0-1ubuntu2.8"
},
{
"binary_name": "libcurl3t64-gnutls",
"binary_version": "8.18.0-1ubuntu2.8"
},
{
"binary_name": "libcurl4t64",
"binary_version": "8.18.0-1ubuntu2.8"
}
],
"availability": "No subscription required",
"priority_reason": "Upstream defined this as low severity"
}
}
],
"modified": "2026-10-20T22:56:55.732958802Z",
"provider": "osv",
"upstream": [
"CVE-2026-87863"
],
"references": [
"https://ubuntu.com/security/CVE-2026-87863",
"https://www.cve.org/CVERecord?id=CVE-2026-87863",
"https://curl.se/docs/CVE-2026-87863.html",
"https://ubuntu.com/security/notices/USN-8927-1",
"https://ubuntu.com/security/notices/USN-8927-2",
"https://ubuntu.com/security/notices/USN-8932-1"
]
},
"related_cves": [
{
"value": "CVE-2026-87863",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 390729,
"published_at": "2026-10-14T06:00:00+00:00"
}