HSTS max-age Overflow Leading to Cache Corruption in curl

Executive Summary

This vulnerability involves an authenticated HTTPS origin supplying an HSTS max-age value that the parser accepts but later fails to process during time serialization. On 64-bit systems, extreme max-age values cause the absolute expiry to exceed calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement. If serialization fails, the temporary file is deleted, leaving an empty or partial cache. The save error is silently ignored, so curl exits successfully despite data loss.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves HSTS max-age values causing time serialization failures in curl on 64-bit systems. Detection requires checking curl versions and examining HSTS cache handling. Monitor for empty or truncated HSTS cache files after HTTPS requests with extreme max-age values.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to data loss in the HSTS cache due to failed serialization of extreme max-age values. It may cause curl to exit successfully even when critical cache operations fail, potentially leaving the system without proper HSTS enforcement. Users relying on HSTS for security may experience reduced protection against man-in-the-middle attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data loss of HSTS cache entries due to improper handling of extreme max-age values, potentially causing unintended exposure of sensitive data or failure to enforce secure connections. This may violate compliance requirements for secure data transmission in standards like GDPR and HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

Update curl to the latest patched version to address the HSTS max-age parsing and serialization issue. Monitor curl logs for cache save errors or data loss events.

Useful 0 Not Useful 0