CVE-2026-87862

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-87862", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "state": "PUBLISHED", "assignerShortName": "curl", "dateReserved": "2026-09-09T13:17:36.482Z", "datePublished": "2026-10-20T20:10:37.039Z", "dateUpdated": "2026-10-30T11:57:49.186Z"}, "containers": {"cna": {"title": "HSTS cache import drops longer-lived child", "descriptions": [{"lang": "en", "value": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild's valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS."}], "providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-10-20T20:10:37.039Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-201 Information Exposure Through Sent Data"}]}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"version": "8.22.0", "status": "affected", "lessThanOrEqual": "8.22.0", "versionType": "semver"}, {"version": "8.21.0", "status": "affected", "lessThanOrEqual": "8.21.0", "versionType": "semver"}, {"version": "8.20.0", "status": "affected", "lessThanOrEqual": "8.20.0", "versionType": "semver"}, {"version": "8.19.0", "status": "affected", "lessThanOrEqual": "8.19.0", "versionType": "semver"}, {"version": "8.18.0", "status": "affected", "lessThanOrEqual": "8.18.0", "versionType": "semver"}, {"version": "8.17.0", "status": "affected", "lessThanOrEqual": "8.17.0", "versionType": "semver"}, {"version": "8.16.0", "status": "affected", "lessThanOrEqual": "8.16.0", "versionType": "semver"}, {"version": "8.15.0", "status": "affected", "lessThanOrEqual": "8.15.0", "versionType": "semver"}, {"version": "8.14.1", "status": "affected", "lessThanOrEqual": "8.14.1", "versionType": "semver"}, {"version": "8.14.0", "status": "affected", "lessThanOrEqual": "8.14.0", "versionType": "semver"}, {"version": "8.13.0", "status": "affected", "lessThanOrEqual": "8.13.0", "versionType": "semver"}, {"version": "8.12.1", "status": "affected", "lessThanOrEqual": "8.12.1", "versionType": "semver"}, {"version": "8.12.0", "status": "affected", "lessThanOrEqual": "8.12.0", "versionType": "semver"}, {"version": "8.11.1", "status": "affected", "lessThanOrEqual": "8.11.1", "versionType": "semver"}, {"version": "8.11.0", "status": "affected", "lessThanOrEqual": "8.11.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2026-87862.json", "name": "json"}, {"url": "https://curl.se/docs/CVE-2026-87862.html", "name": "www"}, {"url": "https://hackerone.com/reports/3972357", "name": "issue"}], "credits": [{"lang": "en", "value": "Stanislav Fort (Aisle Research)", "type": "finder"}, {"lang": "en", "value": "Daniel Stenberg", "type": "remediation developer"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-201", "lang": "en", "description": "CWE-201 Insertion of Sensitive Information Into Sent Data"}]}], "references": [{"url": "https://hackerone.com/reports/3972357", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T11:57:38.044240Z", "id": "CVE-2026-87862", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T11:57:49.186Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-87862", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "state": "PUBLISHED", "assignerShortName": "curl", "dateReserved": "2026-09-09T13:17:36.482Z", "datePublished": "2026-10-20T20:10:37.039Z", "dateUpdated": "2026-10-30T11:57:49.186Z"}, "containers": {"cna": {"title": "HSTS cache import drops longer-lived child", "descriptions": [{"lang": "en", "value": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild's valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS."}], "providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-10-20T20:10:37.039Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-201 Information Exposure Through Sent Data"}]}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"version": "8.22.0", "status": "affected", "lessThanOrEqual": "8.22.0", "versionType": "semver"}, {"version": "8.21.0", "status": "affected", "lessThanOrEqual": "8.21.0", "versionType": "semver"}, {"version": "8.20.0", "status": "affected", "lessThanOrEqual": "8.20.0", "versionType": "semver"}, {"version": "8.19.0", "status": "affected", "lessThanOrEqual": "8.19.0", "versionType": "semver"}, {"version": "8.18.0", "status": "affected", "lessThanOrEqual": "8.18.0", "versionType": "semver"}, {"version": "8.17.0", "status": "affected", "lessThanOrEqual": "8.17.0", "versionType": "semver"}, {"version": "8.16.0", "status": "affected", "lessThanOrEqual": "8.16.0", "versionType": "semver"}, {"version": "8.15.0", "status": "affected", "lessThanOrEqual": "8.15.0", "versionType": "semver"}, {"version": "8.14.1", "status": "affected", "lessThanOrEqual": "8.14.1", "versionType": "semver"}, {"version": "8.14.0", "status": "affected", "lessThanOrEqual": "8.14.0", "versionType": "semver"}, {"version": "8.13.0", "status": "affected", "lessThanOrEqual": "8.13.0", "versionType": "semver"}, {"version": "8.12.1", "status": "affected", "lessThanOrEqual": "8.12.1", "versionType": "semver"}, {"version": "8.12.0", "status": "affected", "lessThanOrEqual": "8.12.0", "versionType": "semver"}, {"version": "8.11.1", "status": "affected", "lessThanOrEqual": "8.11.1", "versionType": "semver"}, {"version": "8.11.0", "status": "affected", "lessThanOrEqual": "8.11.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2026-87862.json", "name": "json"}, {"url": "https://curl.se/docs/CVE-2026-87862.html", "name": "www"}, {"url": "https://hackerone.com/reports/3972357", "name": "issue"}], "credits": [{"lang": "en", "value": "Stanislav Fort (Aisle Research)", "type": "finder"}, {"lang": "en", "value": "Daniel Stenberg", "type": "remediation developer"}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-87862", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-30T11:57:38.044240Z"}}}], "references": [{"url": "https://hackerone.com/reports/3972357", "tags": ["exploit"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-201", "description": "CWE-201 Insertion of Sensitive Information Into Sent Data"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T11:57:28.609Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "curl", "vendor": "curl", "versions": [{"lessThanOrEqual": "8.22.0", "status": "affected", "version": "8.22.0", "versionType": "semver"}, {"lessThanOrEqual": "8.21.0", "status": "affected", "version": "8.21.0", "versionType": "semver"}, {"lessThanOrEqual": "8.20.0", "status": "affected", "version": "8.20.0", "versionType": "semver"}, {"lessThanOrEqual": "8.19.0", "status": "affected", "version": "8.19.0", "versionType": "semver"}, {"lessThanOrEqual": "8.18.0", "status": "affected", "version": "8.18.0", "versionType": "semver"}, {"lessThanOrEqual": "8.17.0", "status": "affected", "version": "8.17.0", "versionType": "semver"}, {"lessThanOrEqual": "8.16.0", "status": "affected", "version": "8.16.0", "versionType": "semver"}, {"lessThanOrEqual": "8.15.0", "status": "affected", "version": "8.15.0", "versionType": "semver"}, {"lessThanOrEqual": "8.14.1", "status": "affected", "version": "8.14.1", "versionType": "semver"}, {"lessThanOrEqual": "8.14.0", "status": "affected", "version": "8.14.0", "versionType": "semver"}, {"lessThanOrEqual": "8.13.0", "status": "affected", "version": "8.13.0", "versionType": "semver"}, {"lessThanOrEqual": "8.12.1", "status": "affected", "version": "8.12.1", "versionType": "semver"}, {"lessThanOrEqual": "8.12.0", "status": "affected", "version": "8.12.0", "versionType": "semver"}, {"lessThanOrEqual": "8.11.1", "status": "affected", "version": "8.11.1", "versionType": "semver"}, {"lessThanOrEqual": "8.11.0", "status": "affected", "version": "8.11.0", "versionType": "semver"}]}], "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild's valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS."}], "id": "CVE-2026-87862", "lastModified": "2026-10-30T12:16:45.787", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-87862", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T11:57:38.044240Z", "version": "2.0.3"}}]}, "published": "2026-10-20T21:17:20.270", "references": [{"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "url": "https://curl.se/docs/CVE-2026-87862.html"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "url": "https://curl.se/docs/CVE-2026-87862.json"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "url": "https://hackerone.com/reports/3972357"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://hackerone.com/reports/3972357"}], "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-201"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank Stanislav Fort (Aisle Research) for reporting this issue.", "bugzilla": {"description": "curl: curl: HSTS cache import drops longer-lived child", "id": "2550638", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550638"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-201", "details": ["A flaw was found in curl. When importing HTTP Strict Transport Security (HSTS) cache records, loading a parent domain entry configured to include subdomains before a longer-lived subdomain entry silently drops the subdomain policy. Consequently, once the parent policy expires, curl fails to upgrade subsequent connections for the subdomain to HTTPS and transmits unencrypted requests, allowing a network attacker to intercept sensitive data."], "name": "CVE-2026-87862", "package_state": [{"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Not affected", "package_name": "build-of-trustee/trustee-rhel9", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Not affected", "package_name": "openshift-sandboxed-containers/osc-podvm-payload-rhel9", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "igvm", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "s390utils", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "snphost", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "trustee", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "snphost", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "curl", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "rust", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:jboss_core_services:1", "fix_state": "Fix deferred", "package_name": "jbcs-httpd24-curl", "product_name": "Red Hat JBoss Core Services"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "foreman", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "openvox-agent", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "puppet-agent", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-10-14T12:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-87862\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-87862"], "statement": "Red Hat has rated this vulnerability as Low impact because exploitation depends on non-default HSTS cache usage and requires an attacker to be positioned on-path to capture unencrypted traffic once the parent rule lapses. In typical Red Hat environments, applications and administrative scripts invoke curl using explicit HTTPS URLs rather than relying on opportunistic HSTS upgrades from a shared cache file. Additionally, curl does not enable HSTS cache loading by default, substantially limiting exposure across standard deployments.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "curl", "vendor": "curl"}], "created": "2026-10-17T02:00:07.712946+00:00", "updated": "2026-10-30T14:15:08.281689+00:00", "vendors": ["curl", "curl$PRODUCT$curl"]}