CVE-2026-87863 HSTS response erases persisted entries
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-87863?
CVE-2026-87863 is a vulnerability in curl, published on 20 Oct 2026.
Official description
An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.
Which versions are affected by CVE-2026-87863?
How do I fix CVE-2026-87863?
Upgrade to a fixed version.
Is CVE-2026-87863 being exploited?
There is no known exploitation of CVE-2026-87863 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-87863, AZL-109911, AZL-109986, AZL-110046, AZL-110142, AZL-110241 and 8 more.