# CVE-2026-87862: curl HSTS cache import drops longer-lived child

Source: https://junglewise.ai/threats/cve-2026-87862-importing-a-includesubdomains-parent-hsts-entry-before-a-longer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-87862 · Severity: info · Published 2026-10-20

curl is a widely-used library and command-line tool for transferring data over HTTPS. When importing HSTS (HTTP Strict Transport Security) cache entries, a bug causes the tool to silently discard child domain policies that outlive their parent domain's policy. After the parent policy expires, curl will downgrade to unencrypted HTTP for the child domain, potentially exposing traffic to man-in-the-middle attacks.

Technologies: [Curl](https://junglewise.ai/threats/technologies/curl-curl). Vendors: [Curl](https://junglewise.ai/threats/vendors/curl).

## Quick answers

**Is CVE-2026-87862 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87862 being exploited in the wild.

**How severe is CVE-2026-87862?** Informational severity, published 20 October 2026.

**Which products and versions are affected?** Curl 8.11.0 to 8.22.0; also 8.14.0–8.14.2, 8.16.0–8.16.1, 8.20.0–8.20.1.

**Is there a fix for CVE-2026-87862?** Yes: fixed in curl 8.14.3, 8.16.2, 8.20.2, 8.23.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-87862 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-87862?** Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in curl 8.14.3, 8.16.2, 8.20.2, 8.23.0

## Technical details

The vulnerability exists in curl's HSTS cache import logic, where an includeSubDomains parent entry imported before a longer-lived child entry causes the child to be dropped. The bug affects HSTS cache handling and has a local attack vector or is triggered during normal cache import operations. An attacker could cause curl to send unencrypted HTTP requests instead of enforcing HTTPS, potentially enabling eavesdropping or session hijacking.

## Affected products

- curl curl 8.11.0 to 8.22.0; also 8.14.0–8.14.2, 8.16.0–8.16.1, 8.20.0–8.20.1

## Timeline

- 2026-08-26: disclosed: Issue reported to curl project
- 2026-10-14: patched: curl 8.23.0 released with fix
- 2026-10-14: advisory: Security advisory published

## References

- [https://curl.se/docs/CVE-2026-87862.html](https://curl.se/docs/CVE-2026-87862.html)
- [https://curl.se/docs/CVE-2026-87862.json](https://curl.se/docs/CVE-2026-87862.json)

## Related threats

- [libcurl credentials leak in CURLINFO_EFFECTIVE_URL](https://junglewise.ai/threats/cve-2026-94266-libcurl-could-accidentally-return-a-url-for-curl-easy-getinfo-s)
- [curl Negotiate authentication credential exposure on redirect](https://junglewise.ai/threats/cve-2026-94265-when-processing-an-http-redirect-to-a-url-containing-userinfo-a)
- [curl stack overflow in MIME structure cleanup](https://junglewise.ai/threats/cve-2026-92391-a-deeply-nested-multipart-mime-structure-constructed-via-the)
- [curl remote-header-name file overwrite bypass](https://junglewise.ai/threats/cve-2026-92390-when-invoked-with-remote-header-name-j-curl-fails-to-preserve-its)
- [curl infinite loop via server response omission](https://junglewise.ai/threats/cve-2026-92387-by-permanently-omitting-the-final-control-response-line-a)