CVE-2026-87863: HSTS Max-Age Information Disclosure Flaw

CVE-2026-87863 Overview

CVE-2026-87863 affects cURL's handling of HTTP Strict Transport Security (HSTS) cache files. An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts but that later fails during time serialization. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits yet exceed calendar time structure bounds. During cache saves, cURL truncates the original HSTS file before writing a temporary replacement. When serialization fails, the temporary file is deleted, leaving an empty or partial cache. The save error is silently ignored, so cURL exits successfully despite data loss.

Critical Impact
A malicious HTTPS server can trigger silent HSTS cache destruction, degrading future HTTPS enforcement for all hosts tracked by the affected client.

Affected Products

cURL (command-line tool and libcurl) builds with HSTS cache persistence enabled
64-bit systems where time_t accepts values exceeding calendar time structure bounds
Applications relying on libcurl's HSTS file for cross-session HTTPS enforcement

Discovery Timeline

2026-10-20 - CVE-2026-87863 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-87863

Vulnerability Analysis

The flaw sits at the boundary between HSTS header parsing and on-disk cache serialization. cURL's parser treats the max-age directive as a valid numeric value even when it is large enough to push the resulting absolute expiry past the range the serializer can represent. The parser and serializer disagree on what constitutes a representable timestamp.

When cURL writes the HSTS cache to disk, it opens the destination file for truncation first and then streams records into a temporary file. If record serialization fails because the expiry cannot be rendered as a calendar time, cleanup logic removes the temporary file. The already-truncated original is never restored. cURL's exit path treats the save failure as non-fatal and returns success to the caller.

The net effect is a persistent downgrade of HSTS protections. Hosts that previously pinned HTTPS no longer appear in the cache, allowing subsequent HTTP requests to those origins without automatic upgrade.

Root Cause

Two defects combine. First, input validation inside the HSTS parser does not clamp max-age to a value the serializer can emit. Second, the save routine truncates the primary cache file before verifying that the replacement can be produced, and it discards errors raised during cleanup.

Attack Vector

An attacker controlling or compromising any HTTPS origin that the victim's cURL client connects to can return a crafted Strict-Transport-Security response header containing an extreme max-age value. cURL accepts the header, updates its in-memory HSTS state, and later destroys the on-disk cache during the save step. No user interaction beyond a normal HTTPS request is required. The vulnerability is described in the cURL CVE-2026-87863 Advisory and the corresponding HackerOne Report #3972373.

See the vendor advisory and HackerOne report for the specific parsing and serialization paths involved. No public exploit code accompanies this disclosure.

Detection Methods for CVE-2026-87863

Indicators of Compromise

HSTS cache files that are empty or truncated immediately after a cURL invocation that completed with exit code 0.
HTTP responses containing Strict-Transport-Security headers with abnormally large max-age values, such as values near or beyond 9999999999999.
Loss of previously persisted HSTS entries without a corresponding user action to clear the cache.

Detection Strategies

Monitor HSTS cache files for unexpected size reductions following outbound HTTPS traffic from automation that uses cURL or libcurl.
Inspect network telemetry for inbound Strict-Transport-Security headers carrying out-of-range max-age values.
Correlate cURL exit status with filesystem events on the HSTS file to detect silent write failures.

Monitoring Recommendations

Log every HSTS cache write operation performed by production tooling, including before and after file sizes.
Alert when scripted cURL jobs produce zero-length HSTS files after processing third-party HTTPS endpoints.
Track cURL and libcurl versions across the fleet so vulnerable builds are visible for prioritized patching.

How to Mitigate CVE-2026-87863

Immediate Actions Required

Inventory all systems and applications that embed cURL or libcurl with HSTS persistence enabled.
Upgrade to the fixed cURL release identified in the cURL CVE-2026-87863 Advisory once available in your distribution channel.
Back up current HSTS cache files before upgrading so prior state can be audited.

Patch Information

Refer to the official cURL CVE-2026-87863 Advisory and the machine-readable cURL CVE-2026-87863 JSON Details for the fixed version numbers, patch commits, and distribution guidance. Apply vendor-supplied packages as they become available for your operating system.

Workarounds

Disable HSTS cache persistence in cURL invocations where it is not required by omitting the --hsts option or the equivalent libcurl setting.
Restrict outbound HTTPS traffic from automated cURL workflows to trusted origins to limit exposure to crafted response headers.
Store HSTS cache files on monitored paths and restore from backup if a silent truncation event is detected.

bash

# Example: run cURL without a persistent HSTS cache
curl --no-hsts https://example.com/

# Example: verify the HSTS file size before and after a request
stat -c '%s %n' ~/.curl-hsts
curl --hsts ~/.curl-hsts https://example.com/
stat -c '%s %n' ~/.curl-hsts