HSTS response erases persisted entries (curl curl)

CVE-2026-87863
HIGH 8.1

At a glance

Source
NVD
EPSS
EPSS 0.27 % · percentile 19 ()
State
PUBLISHED
Published
Updated
Assigner
curl
NVD status
Awaiting Analysis

Description

An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.

Weaknesses (CWE)

  • CWE-201 — Insertion of Sensitive Information Into Sent Data

References

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCISA-ADP
CVSS 3.1HIGH 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HNVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

European references

CERT-FR advisories

Affected products

ProductVersions
curl · curlaffected 8.22.0 ≤ 8.22.0 ; affected 8.21.0 ≤ 8.21.0 ; affected 8.20.0 ≤ 8.20.0 ; affected 8.19.0 ≤ 8.19.0 ; affected 8.18.0 ≤ 8.18.0 ; affected 8.17.0 ≤ 8.17.0

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD