{"id":"CVE-2026-87862","published":"2026-10-20T21:17:20.270","lastModified":"2026-10-22T17:21:57.293","description":"Importing a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild's valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://curl.se/docs/CVE-2026-87862.html","tags":[]},{"url":"https://curl.se/docs/CVE-2026-87862.json","tags":[]},{"url":"https://hackerone.com/reports/3972357","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}