CVE-2026-87862

A flaw was found in curl. When importing HTTP Strict Transport Security (HSTS) cache records, loading a parent domain entry configured to include subdomains before a longer-lived subdomain entry silently drops the subdomain policy. Consequently, once the parent policy expires, curl fails to upgrade subsequent connections for the subdomain to HTTPS and transmits unencrypted requests, allowing a network attacker to intercept sensitive data.

Red Hat has rated this vulnerability as Low impact because exploitation depends on non-default HSTS cache usage and requires an attacker to be positioned on-path to capture unencrypted traffic once the parent rule lapses. In typical Red Hat environments, applications and administrative scripts invoke curl using explicit HTTPS URLs rather than relying on opportunistic HSTS upgrades from a shared cache file. Additionally, curl does not enable HSTS cache loading by default, substantially limiting exposure across standard deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.