Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-87864

IMAP APPEND plus CRLF conversion command injection

Only affects curl 7.30.0 through 8.21.0 when IMAP APPEND uploads use CURLOPT_CRLF. curl rates it Low, while CVSS gives 8.1. Fixed in 8.22.0.

Published
Last modified
published
Not listed in CISA KEV
Specific setups only
Low (curl)
Fix
Fixed in 8.14.3, 8.16.2, 8.20.2, 8.22.0
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: poc
  • Automatable: no
  • Technical impact: total

Summary

Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: poc · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • curl curl

    From 8.21.0 · through 8.21.0; From 8.20.0 · through 8.20.0; From 8.19.0 · through 8.19.0; From 8.18.0 · through 8.18.0; From 8.17.0 · through 8.17.0; From 8.16.0 · through 8.16.0; From 8.15.0 · through 8.15.0; From 8.14.1 · through 8.14.1; From 8.14.0 · through 8.14.0; From 8.13.0 · through 8.13.0; From 8.12.1 · through 8.12.1; From 8.12.0 · through 8.12.0; From 8.11.1 · through 8.11.1; From 8.11.0 · through 8.11.0; From 8.10.1 · through 8.10.1; From 8.10.0 · through 8.10.0; From 8.9.1 · through 8.9.1; From 8.9.0 · through 8.9.0; From 8.8.0 · through 8.8.0; From 8.7.1 · through 8.7.1; From 8.7.0 · through 8.7.0; From 8.6.0 · through 8.6.0; From 8.5.0 · through 8.5.0; From 8.4.0 · through 8.4.0; From 8.3.0 · through 8.3.0; From 8.2.1 · through 8.2.1; From 8.2.0 · through 8.2.0; From 8.1.2 · through 8.1.2; From 8.1.1 · through 8.1.1; From 8.1.0 · through 8.1.0; From 8.0.1 · through 8.0.1; From 8.0.0 · through 8.0.0; From 7.88.1 · through 7.88.1; From 7.88.0 · through 7.88.0; From 7.87.0 · through 7.87.0; From 7.86.0 · through 7.86.0; From 7.85.0 · through 7.85.0; From 7.84.0 · through 7.84.0; From 7.83.1 · through 7.83.1; From 7.83.0 · through 7.83.0; From 7.82.0 · through 7.82.0; From 7.81.0 · through 7.81.0; From 7.80.0 · through 7.80.0; From 7.79.1 · through 7.79.1; From 7.79.0 · through 7.79.0; From 7.78.0 · through 7.78.0; From 7.77.0 · through 7.77.0; From 7.76.1 · through 7.76.1; From 7.76.0 · through 7.76.0; From 7.75.0 · through 7.75.0; From 7.74.0 · through 7.74.0; From 7.73.0 · through 7.73.0; From 7.72.0 · through 7.72.0; From 7.71.1 · through 7.71.1; From 7.71.0 · through 7.71.0; From 7.70.0 · through 7.70.0; From 7.69.1 · through 7.69.1; From 7.69.0 · through 7.69.0; From 7.68.0 · through 7.68.0; From 7.67.0 · through 7.67.0; From 7.66.0 · through 7.66.0; From 7.65.3 · through 7.65.3; From 7.65.2 · through 7.65.2; From 7.65.1 · through 7.65.1; From 7.65.0 · through 7.65.0; From 7.64.1 · through 7.64.1; From 7.64.0 · through 7.64.0; From 7.63.0 · through 7.63.0; From 7.62.0 · through 7.62.0; From 7.61.1 · through 7.61.1; From 7.61.0 · through 7.61.0; From 7.60.0 · through 7.60.0; From 7.59.0 · through 7.59.0; From 7.58.0 · through 7.58.0; From 7.57.0 · through 7.57.0; From 7.56.1 · through 7.56.1; From 7.56.0 · through 7.56.0; From 7.55.1 · through 7.55.1; From 7.55.0 · through 7.55.0; From 7.54.1 · through 7.54.1; From 7.54.0 · through 7.54.0; From 7.53.1 · through 7.53.1; From 7.53.0 · through 7.53.0; From 7.52.1 · through 7.52.1; From 7.52.0 · through 7.52.0; From 7.51.0 · through 7.51.0; From 7.50.3 · through 7.50.3; From 7.50.2 · through 7.50.2; From 7.50.1 · through 7.50.1; From 7.50.0 · through 7.50.0; From 7.49.1 · through 7.49.1; From 7.49.0 · through 7.49.0; From 7.48.0 · through 7.48.0; From 7.47.1 · through 7.47.1; From 7.47.0 · through 7.47.0; From 7.46.0 · through 7.46.0; From 7.45.0 · through 7.45.0; From 7.44.0 · through 7.44.0; From 7.43.0 · through 7.43.0; From 7.42.1 · through 7.42.1; From 7.42.0 · through 7.42.0; From 7.41.0 · through 7.41.0; From 7.40.0 · through 7.40.0; From 7.39.0 · through 7.39.0; From 7.38.0 · through 7.38.0; From 7.37.1 · through 7.37.1; From 7.37.0 · through 7.37.0; From 7.36.0 · through 7.36.0; From 7.35.0 · through 7.35.0; From 7.34.0 · through 7.34.0; From 7.33.0 · through 7.33.0; From 7.32.0 · through 7.32.0; From 7.31.0 · through 7.31.0; From 7.30.0 · through 7.30.0

References 3

curl.se

hackerone.com

FAQ

Questions about CVE-2026-87864

What does this mean?

When curl uploads with IMAP APPEND and CURLOPT_CRLF converts line endings, the byte count it advertises is the raw input count, not the expanded count. The extra overflow bytes are then read and run as pipelined IMAP commands within the authenticated session.Source: curl.se, curl.se

Am I affected, and how do I check?

curl versions 7.30.0 through 8.21.0 are affected, and only in the setup where IMAP APPEND uploads run with CURLOPT_CRLF enabled. To check, compare the installed version with curl --version, and search the application's code or configuration for CURLOPT_CRLF.Source: curl.se, curl.se

What should I do about it?

Upgrade to curl 8.22.0. The fix is also listed for the 8.14.3, 8.16.2 and 8.20.2 release lines.Source: curl.se, curl.se

Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.Source: cve.now feed data

Why is it rated 8.1 High?

CVSS scores the worst case, which gives 8.1 (high). curl rates it Low because the vendor knows how narrow the affected setup is: CURLOPT_CRLF combined with IMAP APPEND uploads.Source: curl.se, curl.se