UNKNOWN NVD

CVE-2026-87862

Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child'

Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.

Remediation

$ sudo apt install --only-upgrade curl

References

Published: 2026-10-20 · Source: NVD · Feed updated: 2026-10-20
This unknown severity vulnerability was published on 2026-10-20 via NVD. A remediation command is available below.
vulnfeed aggregates 18176 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.