A flaw in the curl library causes the HSTS cache importer to drop longer‑lived child domain entries when a parent domain entry with subdomains is loaded first. After the parent policy expires, curl fails to upgrade connections on that subdomain to HTTPS and sends requests unencrypted. This permits a network attacker to intercept and read sensitive data. The weakness stems from improper handling of cached HSTS entries (CWE‑201).

This vulnerability occurs in the curl library itself and is not limited to a single vendor or product. The CVE does not specify a particular curl release, so any installation that employs HSTS caching and has not yet been upgraded to a remediation‑capable version may be affected.

The CVSS score of 8.1 indicates high severity, and the EPSS score is < 1%. The vulnerability is not listed in CISA KEV. Exploitation would typically involve an attacker who can influence or observe the client’s HSTS cache or who is positioned to perform a man‑in‑the‑middle attack after the parent policy lapses. Although the risk is substantial, the impact on confidentiality is significant because traffic that should have been encrypted can be captured in plaintext.