This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-87862 →

UBUNTU-CVE-2026-87862

Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires,...

Original description

The description as published by the source.

Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Ubuntu:22.04:LTS curl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:24.04:LTS curl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:26.10 curl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:26.04:LTS curl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.18.0-1ubuntu2.8"}]}]

References

advisory ubuntu.com
report ubuntu.com
report cve.org
report curl.se