CVE-2026-87862 curl CVE debrief

Who should care

Defenders responsible for configuring and maintaining HSTS cache, particularly those managing curl deployments, should assess exposure and prioritize verification and remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure that HSTS cache configurations are properly managed and that curl is upgraded to a fixed version to prevent potential security issues.

Why it matters

Defenders should prioritize verifying HSTS cache configuration and upgrading to a fixed version of curl to prevent potential security issues.

• Potential loss of valid HSTS policy
• Possible issuance of unencrypted HTTP requests
• Verification of HSTS cache configuration required
• Upgrade to a fixed version of curl recommended

Technical summary

Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry silently drops the child, potentially causing curl to issue unencrypted HTTP requests. This occurs because the longer-lived child entry is discarded when a parent entry with `includeSubDomains` is imported beforehand. As a result, when the parent expires, the child's valid HSTS policy is lost. Defenders should prioritize verifying HSTS cache configuration and upgrading to a fixed version of curl to prevent potential security issues.

Defensive priority

Defenders should prioritize verifying HSTS cache configuration and upgrading to a fixed version of curl.

Recommended defensive actions

• Verify HSTS cache configuration
• Upgrade to a fixed version of curl
• Monitor for potential security issues
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide limited information about the vulnerability, but indicate that importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry silently drops the child, potentially causing curl to issue unencrypted HTTP requests.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.