CVE-2026-87862
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Oct 20, 2026
Vendor
unknown
Description
Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.