CVE-2026-87863 curl CVE debrief

Who should care

Defenders responsible for curl deployments should assess exposure and prioritize verification and updates to address this issue. This includes operators, platform administrators, vulnerability management teams, and security teams who manage or are impacted by curl installations. They should review official advisories, assess affected scope, and plan updates or mitigations accordingly.

Why it matters

Defenders should prioritize verifying and updating curl to address this issue, as it could lead to data loss in HSTS cache files. This vulnerability affects curl deployments and requires attention from defenders responsible for these systems.

• Data loss in HSTS cache files due to silent save errors
• Potential for empty or partial cache files
• Need for verification and updates to curl

Technical summary

The vulnerability occurs when an authenticated HTTPS origin supplies an HSTS `max-age` value that the parser accepts but time serialization later fails to process. On 64-bit systems, extreme max-age values can compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. This affects curl deployments, potentially leading to data loss in HSTS cache files during save errors. Defenders should prioritize verifying and updating curl to address this issue, focusing on affected product context and defensive impact.

Defensive priority

Defenders should prioritize verifying and updating curl to a version that addresses this issue, as it could lead to data loss in HSTS cache files.

Recommended defensive actions

• Verify and update curl to a version that addresses this issue
• Review and update HSTS cache file handling to prevent data loss
• Monitor for potential data loss in HSTS cache files
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. Evidence is limited; defenders should verify and confirm affected scope, severity, and vendor guidance. The vulnerability occurs in curl, affecting HSTS cache file handling. Defenders should review official advisories and assess exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.