CVE-2026-87863 in curl
Summary
by MITRE • 10/20/2026
An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability described involves a critical flaw in how Curl handles HTTP Strict Transport Security (HSTS) policy persistence, specifically concerning the serialization of time values for HSTS max-age directives on 64-bit systems. This issue stems from a discrepancy between the parsing phase and the storage phase of HSTS data management. While the parser correctly accepts extreme or unusually large max-age values provided by an authenticated HTTPS origin, the subsequent logic responsible for converting these relative durations into absolute expiration timestamps fails to account for boundary conditions inherent in standard time integer representations. Specifically, when calculating the expiry date from a very high max-age value, the resulting timestamp may exceed the maximum limit supported by the system's calendar time structure or internal representation limits, leading to an overflow or invalid state during serialization.
This technical flaw manifests primarily during the cache save operation, which is a critical step in maintaining persistent HSTS policies across Curl sessions. The process involves writing data to disk using a temporary file mechanism designed to ensure atomicity and prevent corruption of the primary HSTS storage file. In this workflow, the original HSTS file is truncated first, followed by the writing of new data into the temporary replacement file. However, when the serialization step fails due to the aforementioned time integer overflow or boundary violation, the system does not recover gracefully. Instead, it proceeds with cleanup procedures that delete the incomplete temporary file without restoring the previously valid content from the now-truncated original file.
The operational impact of this vulnerability is severe data loss for HSTS policies stored locally by Curl. Because the error handling logic silently ignores the serialization failure during the cleanup phase, Curl exits with a success status code despite having corrupted or emptied its local cache of trusted domains and their associated security parameters. This means that after encountering such an origin, subsequent requests may lose previously established trust relationships for other domains if they share storage mechanisms, or more directly, the HSTS policy for the affected domain is effectively wiped from the client's secure state. The silent nature of this failure makes it particularly dangerous as users and administrators are unaware that their security posture has been degraded until a potential incident occurs where an expected HSTS enforcement fails due to missing local data.
From a standards perspective, this vulnerability aligns with CWE-754: Improper Check for Unusual or Exceptional Conditions, as the software fails to validate input values against system limits before processing them into critical state changes. It also relates to CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization of Multiple Threads if race conditions are involved in file operations, though the primary issue here is logical error handling and data integrity during failure states. In terms of MITRE ATT&CK mapping, this could be associated with T1557: Adversary-in-the-Middle or more specifically impacts to defense evasion by undermining transport layer security mechanisms if an attacker can manipulate HSTS policies to disable enforcement for specific domains over time through repeated exploitation leading to cache corruption.
Mitigation strategies must focus on robust input validation and safer file system operations. Developers should implement strict bounds checking when converting relative max-age values into absolute timestamps, ensuring that any value resulting in a timestamp outside the valid range of the underlying time library is rejected or capped at a safe maximum before serialization attempts are made. Furthermore, the atomicity of cache updates must be preserved by reversing the file operation order: writing to the temporary file first and only truncating and renaming it if the write succeeds completely. If an error occurs during any step, the original file should remain untouched until all operations are verified as successful. Additionally, logging mechanisms should be enhanced to detect and report such silent failures rather than ignoring them, allowing for operational visibility into potential security state degradation events.