CVE-2026-87862: curl HSTS Policy Information Disclosure

CVE-2026-87862 is an information disclosure vulnerability in curl affecting HSTS policy handling. When parent HSTS entries are imported before child entries, valid policies are dropped, causing unencrypted HTTP requests. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-87862 Overview

CVE-2026-87862 affects curl's HTTP Strict Transport Security (HSTS) cache import logic. When curl imports an HSTS entry for a parent domain with the includeSubDomains directive before importing a longer-lived child entry, the child entry is silently dropped. Once the parent HSTS record expires, the child domain loses its own valid HSTS policy. Subsequent requests to that child host are issued as unencrypted HTTP instead of being upgraded to HTTPS.

Critical Impact
Loss of HSTS enforcement for affected child domains enables downgrade and interception conditions, exposing credentials and session data to on-path attackers.

Affected Products

curl command-line tool with HSTS cache import enabled
libcurl applications relying on persisted HSTS state
Automation and CI pipelines that import HSTS caches across runs

Discovery Timeline

2026-10-20 - CVE-2026-87862 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-87862

Vulnerability Analysis

HSTS instructs clients to connect to a host only over HTTPS for a defined duration. The includeSubDomains directive extends that policy to every subdomain of the parent. curl supports persisting the HSTS cache to disk and reloading it between invocations, which is where this defect appears.

During import, curl evaluates whether an incoming entry is already covered by a previously loaded parent entry carrying includeSubDomains. When the parent is imported first, curl treats the child entry as redundant and discards it. This decision ignores the fact that the child may specify a longer max-age than the parent. When the parent expires, curl no longer holds any HSTS record for the child, and the next request falls back to plaintext HTTP.

Root Cause

The root cause is a precedence error in curl's HSTS cache merge logic. The import routine prioritizes includeSubDomains coverage over per-entry expiration lifetime. The longer max-age of the child entry is not retained, so the effective policy window shrinks to the parent's expiration.

Attack Vector

An on-path attacker benefits from this flaw once the parent HSTS entry expires and the child's protection is gone. The attacker can intercept the initial plaintext HTTP request to the child host, strip or prevent any HTTPS upgrade, and harvest or modify traffic. Exploitation does not require sending malicious data to curl itself. It requires only that a victim import an HSTS cache in the vulnerable order and later make a request to the affected child host. See the cURL CVE-2026-87862 Advisory for vendor-authored details.

No verified public exploit code is available. Refer to the HackerOne Report #3972357 for the original disclosure.

Detection Methods for CVE-2026-87862

Indicators of Compromise

Outbound plaintext HTTP connections to hosts that previously resolved only over HTTPS from the same client.
HSTS cache files containing a parent entry with includeSubDomains but no child entries that were expected to be present.
TLS downgrade events in proxy or network logs correlated with curl or libcurl user agents.

Detection Strategies

Inspect persisted HSTS cache files for parent entries with shorter max-age than their known child policies.
Compare application HSTS expectations against the curl HSTS cache after import to find missing child domains.
Alert on HTTP requests from automation hosts to domains that publish HSTS preload entries.

Monitoring Recommendations

Capture egress HTTP and HTTPS metadata from CI/CD runners and scripting hosts that invoke curl.
Track curl and libcurl versions in asset inventory to prioritize patch rollout.
Review certificate and TLS termination logs for unexpected downgrades from previously-HSTS-protected hosts.

How to Mitigate CVE-2026-87862

Immediate Actions Required

Upgrade curl and libcurl to the fixed release referenced in the cURL CVE-2026-87862 Advisory.
Rebuild HSTS caches from authoritative sources rather than reusing previously exported files.
Audit scripts and services that call curl --hsts to confirm they load from trusted, current cache files.

Patch Information

The curl project has published an advisory and JSON metadata for this issue. Consult the cURL CVE-2026-87862 JSON Data for the exact fixed version and affected version ranges, and apply the vendor patch across all systems using curl or libcurl.

Workarounds

Disable HSTS cache import until the patched version is deployed, accepting the loss of persisted HSTS state.
Pin critical child domains in application configuration so HTTPS is enforced independent of the HSTS cache.
Pre-sort imported HSTS entries so longer-lived child entries are loaded before parent entries carrying includeSubDomains.

bash

# Example: invoke curl without loading a persisted HSTS cache
curl --hsts "" https://example.com/

# Example: force HTTPS at the request level as a defensive measure
curl --proto "=https" --tlsv1.2 https://child.example.com/