Bug 2550666 (CVE-2026-87864)

Summary:	CVE-2026-87864 curl: IMAP APPEND plus CRLF conversion command injection
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	anthomas, csutherl, ehelms, ggainey, jclere, jpasqual, juwatts, mdellweg, mhulan, nmoumoul, osousa, pcreech, pjindal, plodge, rchan, rekumar, rhel-process-autobot, security-response-team, smallamp, szappis, tmalecek, vchlup, vvoronko, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in curl. When curl is configured to perform carriage return and line feed (CRLF) conversion during an Internet Message Access Protocol (IMAP) append operation, it incorrectly reports the raw input size rather than the expanded byte count. Because the receiving server only reads the advertised length as message data, it interprets the remaining overflow bytes as subsequent commands. An attacker capable of supplying message data with line breaks can exploit this issue to execute unauthorized IMAP commands within an authenticated session.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-10-14

Description OSIDB Bzimport 2026-10-13 16:06:52 UTC

IMAP APPEND plus CRLF conversion command injection
==================================================

Project curl Security Advisory, October 14 2026
[Permalink](https://curl.se/docs/CVE-2026-87864.html)

VULNERABILITY
-------------

Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in
the `IMAP APPEND {N}` literal while transmitting line-ending expanded data.
The server reads only $N$ bytes for the payload, causing the remaining
overflow bytes to be interpreted and executed as pipelined IMAP commands
within the authenticated session.

INFO
----

Combining IMAP append with CRLF conversions is probably a rare occasion.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-87864 to this issue.

CWE-130: Improper Handling of Length Parameter Inconsistency

Severity: Low

AFFECTED VERSIONS
-----------------

- Affected versions: curl 7.30.0 to and including 8.21.0
- Not affected versions: curl < 7.30.0 and >= 8.22.0
- Introduced-in: https://github.com/curl/curl/commit/f8c8c76d39ac2fa825481ba42

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION
--------

- Fixed-in: https://github.com/curl/curl/commit/3b547de301342b347fb3c6ea6ae797

RECOMMENDATIONS
---------------

 A - Upgrade curl to version 8.22.0

 B - Apply the patch to your local version

 C - Avoid `CURLOPT_CRLF` with IMAP

TIMELINE
--------

This issue was reported to the curl project on August 26, 2026.

curl 8.22.0 was released on September 2, 2026. This advisory was published on
October 14, 2026.

CREDITS
-------

- Reported-by: Stanislav Fort (Aisle Research)
- Patched-by: Stefan Eissing

Thanks a lot!