Is CVE-2026-87862 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87862 being exploited in the wild.

How severe is CVE-2026-87862?

Informational severity, published 20 October 2026.

Which products and versions are affected?

Curl 8.11.0 to 8.22.0; also 8.14.0–8.14.2, 8.16.0–8.16.1, 8.20.0–8.20.1.

Is there a fix for CVE-2026-87862?

Yes: fixed in curl 8.14.3, 8.16.2, 8.20.2, 8.23.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-87862 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-87862?

Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87862: curl HSTS cache import drops longer-lived child

CVE-2026-87862 · Severity: info · Published 2026-10-20

curl is a widely-used library and command-line tool for transferring data over HTTPS. When importing HSTS (HTTP Strict Transport Security) cache entries, a bug causes the tool to silently discard child domain policies that outlive their parent domain's policy. After the parent policy expires, curl will downgrade to unencrypted HTTP for the child domain, potentially exposing traffic to man-in-the-middle attacks.

Technologies: Curl. Vendors: Curl.

Quick answers

Is CVE-2026-87862 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87862 being exploited in the wild.
How severe is CVE-2026-87862?: Informational severity, published 20 October 2026.
Which products and versions are affected?: Curl 8.11.0 to 8.22.0; also 8.14.0–8.14.2, 8.16.0–8.16.1, 8.20.0–8.20.1.
Is there a fix for CVE-2026-87862?: Yes: fixed in curl 8.14.3, 8.16.2, 8.20.2, 8.23.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87862 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-87862?: Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: curl 8.14.3, 8.16.2, 8.20.2, 8.23.0

Technical details

The vulnerability exists in curl's HSTS cache import logic, where an includeSubDomains parent entry imported before a longer-lived child entry causes the child to be dropped. The bug affects HSTS cache handling and has a local attack vector or is triggered during normal cache import operations. An attacker could cause curl to send unencrypted HTTP requests instead of enforcing HTTPS, potentially enabling eavesdropping or session hijacking.

Affected products

curl curl 8.11.0 to 8.22.0; also 8.14.0–8.14.2, 8.16.0–8.16.1, 8.20.0–8.20.1

Timeline

2026-08-26: disclosed: Issue reported to curl project
2026-10-14: patched: curl 8.23.0 released with fix
2026-10-14: advisory: Security advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.