---
id: "CVE-2026-87864"
kind: "vulnerability"
aliases: ["CVE-2026-87864"]
title: "curl: CRLF option lets uploaded IMAP data run as commands"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["c", "curl", "imap", "libcurl", "package", "php", "python"]
not_affected_if: ["crlf-not-enabled", "no-imap-upload"]
published_at: "2026-10-20T21:17:20+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T05:04:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87864", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# curl: CRLF option lets uploaded IMAP data run as commands

When the CURLOPT_CRLF option is enabled, curl reports the wrong byte count for IMAP APPEND literals, so the extra bytes are read by the server as new IMAP commands. An attacker who can control the uploaded message content can run commands inside the authenticated IMAP session.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Search application code and build files for `CURLOPT_CRLF` or `--crlf` usage with IMAP uploads.
- Check the installed curl version with `curl --version`.

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87864

## From the sources

Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in
the `IMAP APPEND {N}` literal while transmitting line-ending expanded data.
The server reads only $N$ bytes for the payload, causing the remaining
overflow bytes to be interpreted and executed as pipelined IMAP commands
within the authenticated session.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_