Insertion of Sensitive Information Into Sent Data in cURL - CVE-2026-87863

Vulnerability details

The vulnerability allows a remote user to erase persisted HSTS cache entries.

The vulnerability exists due to improper handling of time serialization failures in HSTS cache persistence when saving entries received from an authenticated HTTPS origin. A remote user can supply an HSTS max-age value that the parser accepts but time serialization cannot process to erase persisted HSTS cache entries.

On 64-bit systems, extreme max-age values can produce expiry times within time integer limits but beyond calendar time structure bounds. Cache save errors are silently ignored during cleanup, allowing curl to exit successfully.

Affected software

How to mitigate CVE-2026-87863

External References

• https://curl.se/docs/CVE-2026-87863.html
• https://github.com/curl/curl/commit/0c667188e0c6cda615a036b8a

Related Security Bulletins

• Multiple vulnerabilities in cURL