curl: CVE-2026-87863: HSTS response erases persisted entries

Summary An authenticated HTTPS origin can return a Strict-Transport-Security: max-age value that Curlhstsparse accepts but curlxgmtime cannot later serialize. On 64-bit platforms, max-age=67768036190000000 produces an absolute expiry within timet range but outside struct tm's representable range...

curl: CVE-2023-27537: HSTS double-free

A double-free vulnerability CVE-2023-27537 existed in libcurl's HSTS HTTP Strict Transport Security implementation due to a lack of exclusion control when processing HSTS with multi-threading. This could lead to a use-after-free UAF issue when other threads access entries. An attacker could explo...