Vulnerability Description
An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://curl.se/docs/CVE-2026-87863.html
- https://curl.se/docs/CVE-2026-87863.json
- https://hackerone.com/reports/3972373
- https://hackerone.com/reports/3972373
FAQ
What is CVE-2026-87863?
CVE-2026-87863 is a vulnerability with a CVSS score of 8.1 (HIGH). An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute e...
How severe is CVE-2026-87863?
CVE-2026-87863 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-87863?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.