curl CVE-2026-87862

Requires the application/caller to have curl's HSTS feature explicitly enabled (CURLOPT_HSTS or --hsts) AND to use a persistent HSTS cache file that is exported and re-imported across runs, with at least one longer-lived (e.g. includeSubDomains/child) entry present to be dropped. The defect itself is a parsing/import logic error; actual damage further requires an active on-path network attacker to exploit the resulting loss of HSTS enforcement via a protocol downgrade. Limiting factors: HSTS is off by default in curl, persistence must be configured, and no harm occurs without a separately-positioned MITM attacker - so default and typical curl invocations (no HSTS state) are not affected.

No CVSS vector, EPSS score, KEV listing, or POC is provided in the input - the curl project self-rates this as severity LOW, and no independent exploitation signals are available to contradict or reinforce that. The flaw is a logic error in libcurl's HSTS cache import: when the persisted HSTS store is read back in, a longer-lived entry (described as a 'child', i.e. a subdomain/includeSubDomains-covered host) can be dropped, prematurely shortening or removing HSTS protection for that host. The real-world impact is therefore an indirect weakening of a downgrade defense rather than direct code execution or data theft, and it only matters to the subset of deployments that both enable curl's opt-in HSTS feature (CURLOPT_HSTS / --hsts) and rely on persistent HSTS caching across runs. Realizing any harm additionally requires an on-path/active network attacker to exploit the now-missing HSTS entry via an HTTPS→HTTP downgrade or MITM - a meaningful precondition that lowers practical risk well below what curl's enormous install base might otherwise suggest. Net assessment: low operational priority; patch as part of routine curl 8.23.0 maintenance rather than as an emergency. Signals are consistent (low severity, no exploitation evidence); the main gap is the total absence of a published CVSS vector, so the severity rests on the vendor's own LOW rating.

A long-running application uses libcurl with a persisted HSTS cache and has previously recorded an includeSubDomains/long-lived HSTS entry. After the cache is re-imported, the longer-lived child entry is silently dropped, so curl no longer enforces HTTPS for that host; an attacker positioned on the network then downgrades the next request to cleartext HTTP to intercept or tamper with it. No public exploit identified at time of analysis.