UNKNOWNCVSS not yet scoredVulnerability
CVE-2026-87862
Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.
Properties
- Last source
- FIRST EPSS
- Nvd fetched at
- 2026-10-22T22:14:18.200859+00:00
- Epss score
- 0.00291
- Cve id
- CVE-2026-87862
- First seen by Signal
- 2026-10-21T22:34:35+00:00
- Retrieved at
- 2026-10-22T22:17:35+00:00
- Published at
- 2026-10-20T21:17:20.270
- Last modified
- 2026-10-22T17:21:57.293
- Epss percentile
- 0.20483
Explore deeper with Ninja Signal's threat intelligence graph