Based on the updated description, curl’s HSTS caching logic mishandles an out‑of‑range expiration value sent by a remote HTTPS server. When the cache serialization fails, curl truncates the persistence file and deletes all stored HSTS entries. This removes the safety net that forces secure HTTPS connections for known hosts, potentially allowing future communications to fall back to insecure HTTP.

The vulnerability affects the curl client library and binary whenever persistent HSTS caching is enabled. No specific version ranges are given in the CVE data, so any installation of curl that supports HSTS persistence is at risk.

With a CVSS score of 3.7 the problem is considered low to moderate severity, and the EPSS score is not available. The flaw is only exploitable from the network side: an attacker who can influence the HTTPS response to a curl client can deliberately trigger the serialization failure. The resulting loss of HSTS entries is a security erosion that may enable downgrade and man‑in‑the‑middle attacks, but it does not provide direct code execution or denial of service.