curl / libcurl: Command injection via IMAP APPEND with CRLF conversion
Summary
When CURLOPT_CRLF (or --crlf) is enabled, curl sends the IMAP APPEND literal length based on the raw input size while transmitting line-ending expanded data. The IMAP server then reads only the announced number of bytes, and the overflow is interpreted as additional IMAP commands within the authenticated session. The issue only applies to IMAP uploads combined with CRLF conversion, so most curl usage is not affected. The curl project rates the issue as Low, while the requested CVSS score is 8.1; NVD analysis was still pending.
Affected
- curl 7.30.0 through 8.21.0 (libcurl and curl command line tool)
- Default builds are not affected unless CURLOPT_CRLF is used with IMAP
- Not affected: 8.22.0 and later, 8.20.2 and later in the 8.20.x branch, 8.16.2 and later in the 8.16.x branch, 8.14.3 and later in the 8.14.x branch
Fixed in
- Upgrade to curl 8.22.0 or later (released September 2, 2026)
- Distribution packages: use the fixed versions from your OS vendor's security tracker
- Alternatively, apply commit 3b547de301342b347fb3c6ea6ae7979070793a66
Workaround
- Do not use CURLOPT_CRLF or --crlf for IMAP uploads
- Review scripts, application code and bundled libcurl builds for this option
Exploitation
- Known exploitation in the wild: none found; CISA KEV listing not confirmed
- Public proof of concept: none found
- CISA SSVC assessment: exploitation PoC, not automatable, total technical impact
Our recommendation
- Update curl and libcurl to 8.22.0 or later, or to the fixed package version of your distribution
- Search internal scripts, applications and tools for --crlf or CURLOPT_CRLF used with IMAP
- Inventory bundled libcurl copies in applications and update them
- Prioritize according to the curl Low rating and the exposure of your IMAP upload workflows
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- curl security advisory CVE-2026-87864 curl.se
- curl CVE JSON metadata curl.se
- Original report (HackerOne) hackerone.com
- Debian security tracker security-tracker.debian.org
- Ubuntu curl vulnerability fixes ubuntu.com
- OSV entry CURL-CVE-2026-87864 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:35.
Original description (NVD)
Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.