curl: Loss of persisted HSTS entries after failed cache save
Summary
curl stores HSTS (HTTP Strict Transport Security) entries in a cache file. An HTTPS server the client connects to can send a max-age value that the parser accepts but that later fails during time serialization, so curl truncates the cache file and then deletes its temporary replacement, leaving an empty or partial cache. curl ignores this save error and exits successfully, so stored HTTPS-only rules for affected hosts are silently lost. The vendor rates the issue as Low; the CVSS score of 8.1 comes from CISA's ADP scorer.
Affected
- curl 8.2.0 to and including 8.22.0 (libcurl and the curl command-line tool)
- Versions before 8.2.0 and 8.23.0 or later are not affected according to the vendor.
- Branches 8.14.X, 8.16.X and 8.20.X are fixed in 8.14.3, 8.16.2 and 8.20.2.
- Vendor or distribution builds: Unknown; check with each supplier.
Fixed in
- curl 8.23.0 (released 14 October 2026)
- curl 8.20.2 (8.20.X branch)
- curl 8.16.2 (8.16.X branch)
- curl 8.14.3 (8.14.X branch)
- Patch: commit 08d50a79
- Debian trixie: fixed version Unknown.
Workaround
Unknown. The vendor advises not relying on HSTS, which is no substitute for patching.
Exploitation
- CISA SSVC lists exploitation as 'poc' and automatable as 'no'.
- No active exploitation reported.
- No public exploit confirmed in the research notes.
Our recommendation
- Upgrade curl to 8.23.0 or the fixed branch version, or apply the vendor patch.
- Inventory curl and libcurl on servers, workstations, CI pipelines and appliances, including embedded builds.
- Check the Debian trixie and Ubuntu notices for backported fixes.
- Prioritise hosts that fetch data from external or untrusted HTTPS servers.
- Verify that HSTS cache files are not empty after curl runs.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- curl security advisory CVE-2026-87863 curl.se
- curl CVE metadata (JSON) curl.se
- Original report (HackerOne) hackerone.com
- OSV entry CURL-CVE-2026-87863 osv.dev
- Debian security tracker: curl security-tracker.debian.org
- Ubuntu notice USN-8927-1 ubuntu.com
- Ubuntu notice USN-8932-1 ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:35.
Original description (NVD)
An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.