{"id":"CVE-2026-87864","kind":"vulnerability","aliases":["CVE-2026-87864"],"related":[],"title":"curl: CRLF option lets uploaded IMAP data run as commands","description":"Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in\nthe `IMAP APPEND {N}` literal while transmitting line-ending expanded data.\nThe server reads only $N$ bytes for the payload, causing the remaining\noverflow bytes to be interpreted and executed as pipelined IMAP commands\nwithin the authenticated session.","summary":"When the CURLOPT_CRLF option is enabled, curl reports the wrong byte count for IMAP APPEND literals, so the extra bytes are read by the server as new IMAP commands. An attacker who can control the uploaded message content can run commands inside the authenticated IMAP session.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","curl","imap","libcurl","package","php","python"],"not_affected_if":["crlf-not-enabled","no-imap-upload"],"how_to_check":"- Search application code and build files for `CURLOPT_CRLF` or `--crlf` usage with IMAP uploads.\n- Check the installed curl version with `curl --version`.","fix":null,"status":"open","published_at":"2026-10-20T21:17:20+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T05:04:27+00:00","updated_at":"2026-10-25T05:04:27+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:04:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"curl: CRLF option lets uploaded IMAP data run as commands","impact":"high","summary":"When the CURLOPT_CRLF option is enabled, curl reports the wrong byte count for IMAP APPEND literals, so the extra bytes are read by the server as new IMAP commands. An attacker who can control the uploaded message content can run commands inside the authenticated IMAP session.","category":"package","nicknames":[],"who_cares":["curl","libcurl","imap","c","python","php"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs IMAP commands inside the authenticated session","analyst_note":"Find the affected curl versions and fixed release in the NVD entry or curl security advisories.","how_to_check":"- Search application code and build files for `CURLOPT_CRLF` or `--crlf` usage with IMAP uploads.\n- Check the installed curl version with `curl --version`.","needs_analyst":true,"not_affected_if":["no-imap-upload","crlf-not-enabled"],"who_is_affected":"Only programs that use libcurl with CURLOPT_CRLF set while uploading to IMAP servers with APPEND are exposed. Applications that never upload to IMAP or never enable CRLF conversion can skip it. The sources do not name affected curl versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000587,"input_tokens":3347,"output_tokens":505,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-87864':13A,16A 'advertis':77C 'append':39B,86C 'attack':55B 'authent':68B,121C 'byte':35B,44B,81C,101C,109C 'c':17B 'caus':74C,105C 'command':10A,53B,65B,118C 'content':62B 'control':58B 'count':36B,82C 'crlf':2A,27B,73C 'curl':1A,18B,31B,75C 'curlopt':26B,72C 'cve':11A,14A 'data':7A,95C 'enabl':30B,71C 'end':93C 'execut':114C 'expand':94C 'extra':43B 'imap':6A,19B,38B,52B,69B,85C,117C 'input':80C 'insid':66B 'interpret':112C 'let':4A 'libcurl':20B 'line':92C 'line-end':91C 'liter':40B,88C 'messag':61B 'n':87C,100C 'new':51B 'option':3A,28B 'overflow':108C 'packag':21B 'payload':104C 'php':22B 'pipelin':116C 'python':23B 'raw':79C 'read':46B,98C 'remain':107C 'report':32B 'run':8A,64B 'server':49B,97C 'session':70B,122C 'transmit':90C 'upload':5A,60B 'within':119C 'wrong':34B","nicknames":[],"mitigations":[],"who_affected":"Only programs that use libcurl with CURLOPT_CRLF set while uploading to IMAP servers with APPEND are exposed. Applications that never upload to IMAP or never enable CRLF conversion can skip it. The sources do not name affected curl versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87864","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87864","severity":null,"published_at":"2026-10-20T21:17:20+00:00","modified_at":"2026-10-22T17:21:57+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}