CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection

Q: What configuration is required for exploitation?

The vulnerable behavior requires CURLOPT_CRLF to be enabled during an IMAP APPEND operation. The issue arises when curl converts line endings but advertises the original raw input byte count in the IMAP literal length.

Q: What access does an attacker need to exploit this?

An attacker needs control over data appended through the affected IMAP operation, including content that can produce bytes remaining after the server has consumed the advertised literal length. The injected commands execute within the authenticated IMAP session used by curl.

Q: Who is exposed in practice?

Deployments using Debian curl to perform IMAP APPEND requests with CURLOPT_CRLF enabled are exposed. The impact is limited to the authenticated IMAP account associated with the affected curl session.

Published Oct 20, 2026

Updated

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND {N} literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.

Affected Software

1 affected componentFixes available

debian/curl<=7.88.1-10+deb12u15, <=7.88.1-10+deb12u5, <=8.14.1-2+deb13u5, <=8.14.1-2+deb13u7

8.22.0-18.23.0-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/curl to a version that resolves this vulnerability.
Fixed in 8.22.0-1Fixed in 8.23.0-1

Event History

Oct 15, 2026

CVE Published

via Ubuntu·02:50 PM

Data Sourced

via Ubuntu·02:50 PM

RemedyDescriptionSeverityAffected Software

Data Sourced

via Debian·02:51 PM

DescriptionAffected Software

Oct 20, 2026

CVE Published

via MITRE·08:13 PM

Data Sourced

via MITRE·08:13 PM

DescriptionWeakness

Frequently Asked Questions

What configuration is required for exploitation?

The vulnerable behavior requires CURLOPT_CRLF to be enabled during an IMAP APPEND operation. The issue arises when curl converts line endings but advertises the original raw input byte count in the IMAP literal length.

What access does an attacker need to exploit this?

An attacker needs control over data appended through the affected IMAP operation, including content that can produce bytes remaining after the server has consumed the advertised literal length. The injected commands execute within the authenticated IMAP session used by curl.

Who is exposed in practice?

Deployments using Debian curl to perform IMAP APPEND requests with CURLOPT_CRLF enabled are exposed. The impact is limited to the authenticated IMAP account associated with the affected curl session.

CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection

Affected Software

Remediation

Event History

Frequently Asked Questions

What configuration is required for exploitation?

What access does an attacker need to exploit this?

Who is exposed in practice?

Company

Resources

Contact

Frequently Asked Questions

What configuration is required for exploitation?

What access does an attacker need to exploit this?

Who is exposed in practice?