An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. (CVE-2026-87863)

This vulnerability involves the handling of HSTS max-age values by curl on 64-bit systems. While the parser accepts very large max-age values, the subsequent time serialization fails because the computed absolute expiry time exceeds the bounds of the calendar time structure. During cache save operations, curl truncates the original HSTS file before writing a temporary replacement. If serialization fails, the temporary file is deleted, leaving the HSTS cache empty or partially written. The failure is silently ignored, so curl exits without error even though the HSTS cache data is lost.

The impact is loss of HSTS cache data due to failure in saving the cache when processing extreme max-age values. This could lead to the loss of HSTS policy persistence, potentially weakening HTTPS security enforcement for affected origins until the cache is rebuilt. There is no indication of remote code execution or direct compromise. The error is silent, which may cause unnoticed degradation of security posture.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be aware of the risk of HSTS cache loss when interacting with origins supplying extreme max-age values. Monitoring for updates from the vendor is recommended.