---
id: CVE-2026-87862
title: HSTS cache import drops longer-lived child
summary: |-
  Importing a `includeSubDomains` parent HSTS entry before a longer-lived child
  entry, silently drops the child. Consequently, when the parent expires, the
  child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP
  requests …
severity: none
cwe:
  - CWE-201
vendor: curl
product: curl
affected:
  - curl >= 8.22.0 <= 8.22.0
  - curl >= 8.21.0 <= 8.21.0
  - curl >= 8.20.0 <= 8.20.0
  - curl >= 8.19.0 <= 8.19.0
  - curl >= 8.18.0 <= 8.18.0
  - curl >= 8.17.0 <= 8.17.0
  - curl >= 8.16.0 <= 8.16.0
  - curl >= 8.15.0 <= 8.15.0
  - curl >= 8.14.1 <= 8.14.1
  - curl >= 8.14.0 <= 8.14.0
  - curl >= 8.13.0 <= 8.13.0
  - curl >= 8.12.1 <= 8.12.1
  - curl >= 8.12.0 <= 8.12.0
  - curl >= 8.11.1 <= 8.11.1
  - curl >= 8.11.0 <= 8.11.0
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T20:10:37.039Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-87862'
references:
  - url: 'https://curl.se/docs/CVE-2026-87862.json'
    label: json
  - url: 'https://curl.se/docs/CVE-2026-87862.html'
    label: www
  - url: 'https://hackerone.com/reports/3972357'
    label: issue
tags:
  - cve.org
ingestedAt: '2026-10-20T21:19:21.286Z'
---

## Overview

Importing a `includeSubDomains` parent HSTS entry before a longer-lived child
entry, silently drops the child. Consequently, when the parent expires, the
child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP
requests rather than upgrading to HTTPS.

## Affected

- `curl >= 8.22.0 <= 8.22.0`
- `curl >= 8.21.0 <= 8.21.0`
- `curl >= 8.20.0 <= 8.20.0`
- `curl >= 8.19.0 <= 8.19.0`
- `curl >= 8.18.0 <= 8.18.0`
- `curl >= 8.17.0 <= 8.17.0`
- `curl >= 8.16.0 <= 8.16.0`
- `curl >= 8.15.0 <= 8.15.0`
- `curl >= 8.14.1 <= 8.14.1`
- `curl >= 8.14.0 <= 8.14.0`
- `curl >= 8.13.0 <= 8.13.0`
- `curl >= 8.12.1 <= 8.12.1`
- `curl >= 8.12.0 <= 8.12.0`
- `curl >= 8.11.1 <= 8.11.1`
- `curl >= 8.11.0 <= 8.11.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.