CVE-2026-87863

A flaw was found in curl. When persistent HTTP Strict Transport Security (HSTS) caching is enabled, a remote HTTPS server can return an out-of-range expiration value that fails time serialization during cache saving. Because curl truncates the cache file prior to writing the update, this serialization failure causes the persistent HSTS cache to be deleted or emptied. As a result, stored security policies for known hosts are lost, potentially allowing future connections to fall back to insecure communication.

This vulnerability is rated as Low impact for Red Hat products because persistent HSTS caching is an opt-in feature that is not enabled by default during standard curl transfers. An untrusted HTTPS server responding with an out-of-range expiry value can cause curl to fail during serialization, resulting in an empty or truncated persistent cache file. The blast radius is limited to the loss of saved strict transport security entries between sessions and does not allow remote code execution or data compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.