CVE-2026-87864 in curl
Summary
by MITRE • 10/20/2026
Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data.
The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/20/2026
This vulnerability represents a critical protocol-level flaw in how curl handles multiline text transmission via the IMAP APPEND command when the CURLOPT_CRLF option is enabled. The core issue stems from a discrepancy between the byte count advertised by the client and the actual number of bytes transmitted over the network connection. In standard IMAP operations, the APPEND command utilizes a literal syntax denoted as {N}, where N specifies the exact number of octets that constitute the message body payload. This mechanism allows servers to pre-allocate buffers or prepare for data reception without parsing the content structure prematurely. However, when curl is configured with CURLOPT_CRLF, it performs automatic line-ending conversion on input text, typically transforming Unix-style LF characters into Windows-style CRLF sequences during transmission.
The technical flaw arises because curl calculates and advertises the value of N based on the raw input byte count before these conversions occur. Consequently, if the input data contains any newline characters that are expanded from a single byte to two bytes (CRLF), the actual payload transmitted over the socket becomes larger than the advertised literal size N. The IMAP server adheres strictly to this advertised limit for reading the initial payload block. It consumes exactly N bytes and then assumes the APPEND command is complete, proceeding to parse the subsequent data in the buffer as the next protocol instruction or command within the same authenticated session.
This behavior creates a severe security risk known as HTTP/IMAP Request Smuggling or Command Injection via Literal Overflow. Because the remaining overflow bytes are interpreted as pipelined IMAP commands, an attacker who can control the input content sent to curl can inject arbitrary malicious commands into the stream. These injected commands execute within the context of the authenticated user session on the mail server. This bypasses standard authentication checks for those specific commands and allows for unauthorized actions such as reading private emails, deleting messages, modifying folders, or potentially executing further exploits depending on the capabilities exposed by the target IMAP server implementation.
The operational impact is significant, particularly in environments where curl is used programmatically to interact with mail servers through automated scripts or applications that do not strictly validate output lengths. An attacker could exploit this if they have access to a system running vulnerable versions of curl and can influence the data being appended via email drafts or other inputs processed by the application. The ability to inject commands effectively breaks the isolation between different IMAP operations, potentially leading to full account compromise or lateral movement within an organization's mail infrastructure.
Mitigation strategies must address both the client-side configuration and server-side validation. For users of curl, disabling CURLOPT_CRLF is the most direct remediation if line-ending conversion is not strictly required for the specific use case. Alternatively, ensuring that applications using libcurl manually calculate and set the correct literal size based on the post-conversion byte count can prevent the mismatch. On the server side, IMAP implementations should implement strict length validation that accounts for potential protocol ambiguities or reject commands where the received data exceeds the declared literal size without proper termination signals. Regular security audits of mail client libraries and adherence to RFC 3501 standards regarding literal handling are essential to preventing such exploitation vectors in production environments.