IMAP APPEND plus CRLF conversion command injection
==================================================

Project curl Security Advisory, October 14 2026
[Permalink](https://curl.se/docs/CVE-2026-87864.html)

VULNERABILITY
-------------

Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in
the `IMAP APPEND {N}` literal while transmitting line-ending expanded data.
The server reads only $N$ bytes for the payload, causing the remaining
overflow bytes to be interpreted and executed as pipelined IMAP commands
within the authenticated session.

INFO
----

Combining IMAP append with CRLF conversions is probably a rare occasion.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-87864 to this issue.

CWE-130: Improper Handling of Length Parameter Inconsistency

Severity: Low

AFFECTED VERSIONS
-----------------

- Affected versions: curl 7.30.0 to and including 8.21.0
- Not affected versions: curl < 7.30.0 and >= 8.22.0
- Introduced-in: https://github.com/curl/curl/commit/f8c8c76d39ac2fa825481ba42

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION
--------

- Fixed-in: https://github.com/curl/curl/commit/3b547de301342b347fb3c6ea6ae797

RECOMMENDATIONS
---------------

 A - Upgrade curl to version 8.22.0

 B - Apply the patch to your local version

 C - Avoid `CURLOPT_CRLF` with IMAP

TIMELINE
--------

This issue was reported to the curl project on August 26, 2026.

curl 8.22.0 was released on September 2, 2026. This advisory was published on
October 14, 2026.

CREDITS
-------

- Reported-by: Stanislav Fort (Aisle Research)
- Patched-by: Stefan Eissing

Thanks a lot!