Tools AI-Found Vulnerability Register aifv-0101
Register entry
curl: HSTS cache import drops longer-lived child
- CVE
- CVE-2026-87862
- Project
- curl
- Component
- curl and libcurl
- Finder
- AISLE
- Autonomy
- AI-assisted audit with human report review, according to AISLE
- Evidence tier
- Claim outside the record
- Assigner
- curl
- Severity
- Low (curl vendor rating)
- Confidence
- SINGLE
What happened
Importing overlapping HSTS entries could discard a longer-lived child policy and later allow HTTP. curl rates the issue Low.
Credit as recorded: Stanislav Fort (Aisle Research). The vendor credits Stanislav Fort (Aisle Research). The first fixed main release was 8.23.0 on 14 October 2026; public disclosure followed on 14 October. AISLE attributes the finding to its AI-assisted audit. The vendor advisory names the human researcher, so machine involvement is recorded as an external claim. Date basis: vendor advisory publication.
Sources
- curl vendor advisorycurl.se/docs/CVE-2026-87862.html
- AISLE account of the auditaisle.com/blog/one-aisle-curl-audit-produced-24-cves-18-ship…
One record from the AI-Found Vulnerability Register, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 28 October 2026