Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
CMake 3.30.3-15 can lose HTTPS security settings
published 15 days ago
Summary
When CMake runs on a 64‑bit system, a specially crafted HTTPS site can send an unusually large HSTS "max‑age" value that CMake cannot correctly store. The process may truncate the HSTS cache file, leaving it empty or incomplete, and CMake continues without reporting the error. Update CMake to a newer version or avoid using very large HSTS values to prevent loss of security information.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | cmake | <= 3.30.3-15 |
Original advisory text
CVE-2026-87863 affecting package cmake 3.30.3-15
An authenticated HTTPS origin can supply an HSTS `max-age` value that the
parser accepts, but time serialization later fails to process. On 64-bit
systems, extreme max-age values compute an absolute expiry within standard
time integer limits that exceeds calendar time structure bounds. During cache
saves, the original HSTS file is truncated before writing a temporary
replacement; when serialization fails, the temporary file is deleted, leaving
an empty or partial cache. Because the save error is silently ignored during
cleanup, curl exits successfully despite the data loss.
parser accepts, but time serialization later fails to process. On 64-bit
systems, extreme max-age values compute an absolute expiry within standard
time integer limits that exceeds calendar time structure bounds. During cache
saves, the original HSTS file is truncated before writing a temporary
replacement; when serialization fails, the temporary file is deleted, leaving
an empty or partial cache. Because the save error is silently ignored during
cleanup, curl exits successfully despite the data loss.
References
Timeline
Published20 Oct 2026
Updated23 Oct 2026
First seen23 Oct 2026
Sources
AZL-109911 · OSV
Track software like this
Free during beta