CVE-2026-87864

Name of the Vulnerable Software and Affected Versions curl (affected versions not specified)

Description Enabling CURLOPT CRLF allows for command injection during IMAP APPEND operations. When transmitting line-ending expanded data, curl advertises the raw input byte count in the IMAP APPEND {N} literal. Because the server only reads $N$ bytes for the payload, any remaining overflow bytes are interpreted and executed as pipelined IMAP commands within the authenticated session.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.