Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. (CVE-2026-87862)

The vulnerability (CVE-2026-87862) involves the processing order of HSTS entries in curl. When a parent domain's HSTS entry with includeSubDomains is imported before a child domain's longer-lived HSTS entry, the child's entry is silently discarded. Consequently, after the parent domain's HSTS policy expires, the child domain's valid HSTS policy is lost, causing curl to fail to upgrade HTTP requests to HTTPS for that child domain.

The impact is that curl may issue unencrypted HTTP requests to child domains that should have enforced HTTPS due to their valid HSTS policies. This could potentially expose communications to interception or downgrade attacks if an attacker can exploit the absence of HTTPS enforcement. However, no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be aware of this behavior and consider manual verification of HSTS policies or alternative mitigations to ensure HTTPS enforcement for child domains.