Is CVE-2026-87863 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87863 being exploited in the wild.

How severe is CVE-2026-87863?

Informational severity, published 20 October 2026.

Which products and versions are affected?

Curl 8.2.0 to 8.22.0 (multiple branches affected; see fixed_in for per-branch details).

Is there a fix for CVE-2026-87863?

Yes: fixed in curl 8.23.0, 8.20.2 (8.20.x branch), 8.16.2 (8.16.x branch), 8.14.3 (8.14.x branch). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-87863 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-87863?

Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87863: curl HSTS cache data loss on serialization failure

CVE-2026-87863 · Severity: info · Published 2026-10-20

curl is a widely-used tool for transferring data over networks. An HTTPS server can send specially crafted HSTS (HTTP Strict Transport Security) headers that cause curl's cache file to be truncated and left empty, without any error warning to the user. This results in silent data loss of stored security policy information, potentially weakening the browser's protection on subsequent connections.

Technologies: Curl. Vendors: Curl.

Quick answers

Is CVE-2026-87863 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87863 being exploited in the wild.
How severe is CVE-2026-87863?: Informational severity, published 20 October 2026.
Which products and versions are affected?: Curl 8.2.0 to 8.22.0 (multiple branches affected; see fixed_in for per-branch details).
Is there a fix for CVE-2026-87863?: Yes: fixed in curl 8.23.0, 8.20.2 (8.20.x branch), 8.16.2 (8.16.x branch), 8.14.3 (8.14.x branch). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87863 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-87863?: Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: curl 8.23.0, 8.20.2 (8.20.x branch), 8.16.2 (8.16.x branch), 8.14.3 (8.14.x branch)

Technical details

When an authenticated HTTPS origin supplies an extreme HSTS max-age value, curl's parser accepts it but later time serialization fails due to timestamp overflow on 64-bit systems. During cache save operations, the original HSTS file is truncated before writing, and when serialization fails, the temporary file is deleted but the error is silently suppressed. The vulnerability requires network access from an HTTPS origin and results in erasure of persisted HSTS entries without alerting the user.

Affected products

curl curl 8.2.0 to 8.22.0 (multiple branches affected; see fixed_in for per-branch details)

Timeline

2026-08-26: disclosed: Issue reported to curl project
2026-10-14: patched: curl 8.23.0 released with fix
2026-10-14: advisory: Security advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.