CVE WATCH / VULNERABILITY DETAIL
CVE-2026-87862
UNKNOWNCVSS 0NVD feed
Published 20 October 2026 · tracked since 21 October 2026
Description
Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog