CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection
Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND {N} literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.
Other sources
IMAP APPEND plus CRLF conversion command injection
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.22.0-1Fixed in 8.23.0-1 - Upgrade
Upgrade
alpine/curlto a version that resolves this vulnerability.Fixed in 8.23.0-r0 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.22.0-1 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 7.35.0-1ubuntu2.20+esm24 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 7.47.0-1ubuntu2.19+esm21 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 7.58.0-2ubuntu3.24+esm15 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 7.68.0-1ubuntu2.25+esm10 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 7.81.0-1ubuntu1.30 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.5.0-2ubuntu10.16 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.20.0-2ubuntu11.1 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.18.0-1ubuntu2.8 - Upgrade
Upgrade
azurelinux/curlto a version that resolves this vulnerability.Fixed in 8.11.1-13
Event History
Frequently Asked Questions
What configuration is required for exploitation?
The vulnerable behavior requires CURLOPT_CRLF to be enabled during an IMAP APPEND operation. The issue arises when curl converts line endings but advertises the original raw input byte count in the IMAP literal length.
What access does an attacker need to exploit this?
An attacker needs control over data appended through the affected IMAP operation, including content that can produce bytes remaining after the server has consumed the advertised literal length. The injected commands execute within the authenticated IMAP session used by curl.
Who is exposed in practice?
Deployments using Debian curl to perform IMAP APPEND requests with CURLOPT_CRLF enabled are exposed. The impact is limited to the authenticated IMAP account associated with the affected curl session.