HSTS cache file: three trailing dots silently disable HSTS for that host

**Researcher:** Maturi Jaswanth Sai **Program:** curl (HackerOne) **Asset:** github.com/curl/curl, `lib/hsts.c` **Affected:** curl 8.20.0, 8.21.0, 8.22.0 and 8.23.0 (tag `curl-8_23_0`, 2026-10-14), plus master `eb2b201a` (8.23.1-DEV, 2026-10-19) **Weakness:** CWE-295 / CWE-693, an HSTS pin that …

  if(hostlen && (host[hostlen - 1] == '.'))
    /* strip off any trailing dot */
    hostlen--;

  if(hostlen) {
    /* only add it if not already present */
    e = hsts_check(h, host, hostlen, FALSE);
    if(!e)
      result = hsts_create(h, host, hostlen, subdomain, expires);