CVE-2026-87863

Sin historial EPSS suficiente todavía.

An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.

• curl.sehttps://curl.se/docs/CVE-2026-87863.html
• curl.sehttps://curl.se/docs/CVE-2026-87863.json
• hackerone.comhttps://hackerone.com/reports/3972373

Sin CVEs relacionados por CWE o producto.