Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.

Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.

curl-8.23.0-1.1 on GA media

curl: libcurl: Curl out of bounds read for cookie path curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers curl: libcurl: Improper certificate validation due to cached TLS settings reuse curl: curl: stale SigV4 headers sent unintended curl: curl: redirect to SFTP or SCP bypasses host verification curl: curl: FTP connection reuse inherits client-certificate curl: curl: server-set cookie erases cookie jar curl: curl: Negotiate credentials sent to redirected origin curl: curl: leaking host credentials to HTTP proxy curl: curl: cross-origin reuse of a Negotiate connection curl: curl: HSTS cache import drops longer-lived child curl: curl: Hsts Response Erases Persisted Entries curl: IMAP APPEND plus CRLF conversion command injection curl: curl: knownhost callback mismatches key as missing curl: curl: wolfSSL public-key pinning bypass curl: curl: server-set cookie aborts cookie jar load curl: curl: never-ending loop via server response omission curl: curl: FTP wildcard write callback mixup curl: curl: TFTP direction confusion curl: curl: -J no-clobber guarantee bypassed with 103 early hints curl: curl: curl_mime_free stack overflow by recursion curl: curl: HTTP/2 upload Use-After-Free curl: curl: Authorization: Negotiate sent to foreign origin curl: curl: password leak in CURLINFO_EFFECTIVE_URL curl: curl: info leak uploading over WebSockets with GnuTLS curl: curl: local interface connection reuse mixup

Affected: Ubuntu:22.04:LTS: curl, Ubuntu:24.04:LTS: curl, Ubuntu:26.10: curl, Ubuntu:26.04:LTS: curl

Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.