What is GHSA-29c5-pmm5-3j3x?

GHSA-29c5-pmm5-3j3x is a security advisory published by GitHub Security Advisories with High severity. Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently...

Which CVE IDs does GHSA-29c5-pmm5-3j3x cover?

GHSA-29c5-pmm5-3j3x covers the following CVE IDs: CVE-2026-87862. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-29c5-pmm5-3j3x?

GHSA-29c5-pmm5-3j3x has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

GHSA-29c5-pmm5-3j3xHighCVSS 8.1

Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently...

Vendor

GitHub Security Advisories

Published

October 20, 2026

Last Modified

October 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-87862 →

📋 Description

Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-87862
https://hackerone.com/reports/3972357
https://curl.se/docs/CVE-2026-87862.html
https://curl.se/docs/CVE-2026-87862.json
https://github.com/advisories/GHSA-29c5-pmm5-3j3x