CVE-2023-23915: HSTS amnesia with --parallel

How it was found

Summary:

curl overwrites HSTS cache entries if requests are performed in parallel.

Steps To Reproduce:

1. curl --parallel --hsts hsts.txt https://site1.tld https://site2.tld https://site3.tld

Only one of the sites contacted will have entry in hsts.txt afterwards. Non-TLS connection to the other sites will not protected by TLS.

Impact

Request performed over insecure channels unexpectedly and loss of confidentiality and integrity.