CVE-2026-87862
NONE—CVSS v3
—CVSS v2
0.29%
EPSS (exploit probability)
—CWE
Description
Importing a `includeSubDomains` parent HSTS entry before a longer-lived child
entry, silently drops the child. Consequently, when the parent expires, the
child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP
requests rather than upgrading to HTTPS.
Affected routers (0)
No routers currently mapped to this CVE in our database.