The reason for this bug is that save function appended a suffix to the file name, created a temporary file and then in the last step renamed that to the final name. When the filename length was close to the limit of what is allowed on the file system, adding the extension would make it too long and then trigger this bug.

When saving HSTS data to an excessively long filename, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.

Starting in curl 8.5.0, the temporary filename made done using a pure random sequence of letters instead of being based on the original.