Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.
CVE-2026-87862
CVSS base score
8.1 (v3.1)
Severity
HIGH
Attack vector
Network
Weakness
CWE-201
Last modified
October 30, 2026
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H