CVE-2026-87863
Publication date 14 October 2026
Last updated 3 November 2026
Ubuntu priority
Description
An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.
Why is this CVE low priority?
Upstream defined this as low severity
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| curl | 26.10 stonking |
Fixed in 8.20.0-2ubuntu11.1
|
| 26.04 LTS resolute |
Fixed in 8.18.0-1ubuntu2.8
|
|
| 24.04 LTS noble |
Fixed in 8.5.0-2ubuntu10.16
|
|
| 22.04 LTS jammy |
Not affected
|
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty |
Not affected
|
Severity score breakdown
CVSS version: CVSS v3.0
Base score
8.1 · High
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Related Ubuntu Security Notices (USN)
- USN-8927-1
- curl vulnerabilities
- 14 October 2026
- USN-8932-1
- curl vulnerabilities
- 14 October 2026
- USN-8927-2
- curl vulnerabilities
- 19 October 2026