CVE-2026-87864
IMAP APPEND plus CRLF conversion command injection
Project curl Security Advisory, October 14 2026 Permalink
VULNERABILITY
Enabling CURLOPT_CRLF causes curl to advertise the raw input byte count in the IMAP APPEND {N} literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow
bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.
INFO
Combining IMAP append with CRLF conversions is probably a rare occasion.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-87864 to this issue.
CWE-130: Improper Handling of Length Parameter Inconsistency
Severity: Low
AFFECTED VERSIONS
- Affected versions: curl 7.30.0 to and including 8.21.0
- Not affected versions: curl < 7.30.0 and >= 8.22.0
- Not affected versions: curl >= 8.20.2 in the 8.20.X branch
- Not affected versions: curl >= 8.16.2 in the 8.16.X branch
- Not affected versions: curl >= 8.14.3 in the 8.14.X branch
- Introduced-in: https://github.com/curl/curl/commit/f8c8c76d39ac2fa825481ba42
libcurl is used by many applications, but not always advertised as such!
This flaw also affects the curl command line tool.
SOLUTION
RECOMMENDATIONS
A - Upgrade curl to version 8.22.0
B - Apply the patch to your local version
C - Avoid CURLOPT_CRLF with IMAP
TIMELINE
This issue was reported to the curl project on August 26, 2026.
curl 8.22.0 was released on September 2, 2026. This advisory was published on October 14, 2026.
CREDITS
- Reported-by: Stanislav Fort (Aisle Research)
- Patched-by: Stefan Eissing
Thanks a lot!