CVE-2026-87862None▾ SunlitImporting a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Importing a includeSubDomains parent HSTS entry before a longer-lived child
entry, silently drops the child. Consequently, when the parent expires, the
child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP
requests rather than upgrading to HTTPS.
curl >= 8.22.0 <= 8.22.0curl >= 8.21.0 <= 8.21.0curl >= 8.20.0 <= 8.20.0curl >= 8.19.0 <= 8.19.0curl >= 8.18.0 <= 8.18.0curl >= 8.17.0 <= 8.17.0curl >= 8.16.0 <= 8.16.0curl >= 8.15.0 <= 8.15.0curl >= 8.14.1 <= 8.14.1curl >= 8.14.0 <= 8.14.0curl >= 8.13.0 <= 8.13.0curl >= 8.12.1 <= 8.12.1curl >= 8.12.0 <= 8.12.0curl >= 8.11.1 <= 8.11.1curl >= 8.11.0 <= 8.11.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-87861Nonecross-origin reuse of a Negotiate connection
CVE-2026-86415Noneauto client cert connection reuse mixup
CVE-2026-86414Noneleaking host credentials to HTTP proxy
CVE-2026-87863NoneHSTS response erases persisted entries
CVE-2026-86409Nonestale SigV4 headers sent unintended
CVE-2026-86413NoneNegotiate credentials sent to redirected origin