From a3f4fd25d3991fe955afa2f5e3994c04339cc842 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Sun, 7 Dec 2025 12:35:42 +0100
Subject: [PATCH] http: return OOM errors from hsts properly

When Curl_hsts_parse() fails with out of memory, return it to parent.

Closes #19862
---
 lib/http.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/http.c b/lib/http.c
index ba42f19ff0..ce5f5becdf 100644
--- a/lib/http.c
+++ b/lib/http.c
@@ -3501,8 +3501,11 @@ static CURLcode http_header_s(struct Curl_easy *data,
   if(v) {
     CURLcode check =
       Curl_hsts_parse(data->hsts, conn->host.name, v);
-    if(check)
+    if(check) {
+      if(check == CURLE_OUT_OF_MEMORY)
+        return check;
       infof(data, "Illegal STS header skipped");
+    }
 #ifdef DEBUGBUILD
     else
       infof(data, "Parsed STS header fine (%zu entries)",