Insertion of Sensitive Information Into Sent Data in cURL - CVE-2026-87862

Vulnerability details

The vulnerability allows a remote attacker to obtain information sent over unencrypted HTTP.

The vulnerability exists due to incorrect discarding of longer-lived child HSTS entries in curl's HSTS cache import functionality when importing an includeSubDomains parent entry before a longer-lived child entry. A remote attacker can take advantage of the loss of HTTPS enforcement after the parent entry expires to obtain information sent over unencrypted HTTP.

Affected software

How to mitigate CVE-2026-87862

External References

• https://curl.se/docs/CVE-2026-87862.html
• https://github.com/curl/curl/commit/a94973805df96269bf3f3bf0a2

Related Security Bulletins

• Multiple vulnerabilities in cURL