{
  "cveId": "CVE-2026-87863",
  "url": "https://patchblox.com/security/cve/CVE-2026-87863",
  "summary": "CVE-2026-87863 is fixed in 3 products on 1 platform, first by curl 8.5.0-2ubuntu10.16, released October 21, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "HSTS response erases persisted entries",
  "description": "An authenticated HTTPS origin can supply an HSTS \u0060max-age\u0060 value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.",
  "published": "2026-10-13T23:00:00Z",
  "severity": "Moderate",
  "cvss": 6.5,
  "epss": 0.00828,
  "epssPercentile": 0.57752,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87863",
  "fixes": [
    {
      "platform": "linux",
      "product": "curl",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "8.5.0-2ubuntu10.16",
      "fix": "curl 8.5.0-2ubuntu10.16",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-curl-8.5.0-2ubuntu10.16",
      "released": "2026-10-21T16:55:08Z"
    },
    {
      "platform": "linux",
      "product": "curl",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "8.18.0-1ubuntu2.8",
      "fix": "curl 8.18.0-1ubuntu2.8",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-curl-8.18.0-1ubuntu2.8",
      "released": "2026-11-07T00:38:05Z"
    },
    {
      "platform": "linux",
      "product": "curl",
      "release": "sles 15.6",
      "fixedVersion": "8.22.0-150600.4.58.1",
      "fix": "SUSE-SU-2026:5069-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5069-1",
      "released": "2026-11-07T00:42:08Z"
    },
    {
      "platform": "linux",
      "product": "curl",
      "release": "sles 15.7",
      "fixedVersion": "8.22.0-150700.7.33.1",
      "fix": "SUSE-SU-2026:5068-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5068-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "libcurl3t64-gnutls",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "8.5.0-2ubuntu10.16",
      "fix": "libcurl3t64-gnutls 8.5.0-2ubuntu10.16",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-libcurl3t64-gnutls-8.5.0-2ubuntu10.16",
      "released": "2026-10-21T16:55:08Z"
    },
    {
      "platform": "linux",
      "product": "libcurl3t64-gnutls",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "8.18.0-1ubuntu2.8",
      "fix": "libcurl3t64-gnutls 8.18.0-1ubuntu2.8",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-libcurl3t64-gnutls-8.18.0-1ubuntu2.8",
      "released": "2026-11-07T00:38:05Z"
    },
    {
      "platform": "linux",
      "product": "libcurl4t64",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "8.5.0-2ubuntu10.16",
      "fix": "libcurl4t64 8.5.0-2ubuntu10.16",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-libcurl4t64-8.5.0-2ubuntu10.16",
      "released": "2026-10-21T16:55:08Z"
    },
    {
      "platform": "linux",
      "product": "libcurl4t64",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "8.18.0-1ubuntu2.8",
      "fix": "libcurl4t64 8.18.0-1ubuntu2.8",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-libcurl4t64-8.18.0-1ubuntu2.8",
      "released": "2026-11-07T00:38:05Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T13:31:49Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}