curl and libcurl: Dropped HSTS child entry during cache import
Summary
curl and libcurl, including the curl command line tool, silently drop a longer-lived HSTS child entry when an includeSubDomains parent entry is imported first. After the parent expires, curl stops upgrading requests to HTTPS and sends unencrypted HTTP requests. An attacker with a network position to intercept traffic could read or modify these requests. The CNA scores the issue 8.1, while the curl project rates it Low, and NVD analysis is still pending.
Affected
- curl 8.11.0 to 8.22.0
- Not affected: versions before 8.11.0, 8.23.0 and later, 8.20.2 and later in 8.20.x, 8.16.2 and later in 8.16.x, 8.14.3 and later in 8.14.x
- Distributions: Ubuntu 26.04 LTS is fixed in 8.18.0-1ubuntu2.8; Ubuntu 24.04 and 22.04 are listed as vulnerable; Debian bookworm is not affected, trixie and forky are vulnerable
Fixed in
- curl 8.23.0 (released October 14, 2026), fix commit a1614c3
- Ubuntu 26.04 LTS: 8.18.0-1ubuntu2.8
- Debian sid: 8.23.0
- Other distributions: Unknown, check the vendor advisory
Workaround
- No vendor-documented workaround.
- The curl project recommends not relying on HSTS and applying the patch to the local version.
Exploitation
- No exploitation in the wild found; not listed in CISA KEV in the sources checked.
- CISA SSVC lists exploitation as 'poc', automatable: no, technical impact: total.
- No public PoC repository found in the research.
Our recommendation
- Inventory curl and libcurl versions, including distribution packages and embedded copies.
- Upgrade to curl 8.23.0 or install the distribution patch.
- Prioritise systems and scripts that use a persisted HSTS cache file, such as updaters and backup jobs.
- Check appliances and firewalls with bundled curl separately with their vendors.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- curl security advisory CVE-2026-87862 curl.se
- curl CVE metadata (JSON) curl.se
- Original report on HackerOne hackerone.com
- Ubuntu security notice USN-8927-1 ubuntu.com
- Ubuntu CVE tracker entry ubuntu.com
- Debian security tracker security-tracker.debian.org
- OSV entry CURL-CVE-2026-87862 osv.dev
- Ubuntu security notice USN-8932-1 ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:34.
Original description (NVD)
Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.