Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply crafted IMAP APPEND content
-
ExploitCRLF conversion emits injected line breaks
-
ExecutionSmuggle unauthorized IMAP commands
-
ImpactManipulate mailbox state in session
Vulnerability Assessment
| Exploitation Conditions | Requires an application using libcurl's IMAP APPEND upload with CRLF conversion enabled (CURLOPT_CRLF option or the curl --crlf flag), which is NOT the default, combined with attacker influence over the content being appended. Limiting factors: CRLF conversion must be explicitly turned on by the integrating application; the attacker must control part of the uploaded message body; and impact is bounded to IMAP protocol commands within an already-established (typically authenticated) IMAP session rather than host-level code execution. Applications not using IMAP, or using it without CRLF conversion, are unaffected. |
| Impact | No CVSS vector, CWE, EPSS, KEV, or POC data is provided in the input, so all risk signals here are inferred. The curl project itself rates this vulnerability as severity LOW, which is the strongest authoritative signal available. The flaw is an IMAP protocol command-injection: when libcurl's CRLF conversion is active during an IMAP APPEND upload, attacker-influenced content can embed CR/LF sequences that smuggle additional IMAP commands into the session. This is NOT OS/remote-code command injection - impact is confined to the IMAP control channel. Real-world risk is modest: it requires an application that (a) uses libcurl's IMAP APPEND and (b) enables CRLF conversion (CURLOPT_CRLF / --crlf), which is not the default, and (c) feeds attacker-controlled data into the uploaded message. There is no evidence of active exploitation (not in CISA KEV per input) and no public exploit identified. Despite curl being one of the most ubiquitous software components in existence, the narrow feature combination required makes this a low-priority issue rather than a widespread threat - consistent with the vendor's LOW rating. Key caveat: NVD has not yet published a CVSS vector or CWE, so severity rests solely on the curl advisory. |
| Exploit ScenarioDerived | An application uses libcurl to append messages to an IMAP mailbox with CRLF conversion enabled and includes attacker-supplied text in the message body. The attacker embeds CRLF-delimited IMAP command sequences in that text, which libcurl transmits verbatim after conversion, causing the IMAP server to execute injected commands within the authenticated session. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
CRLF-driven IMAP command injection in curl/libcurl's IMAP APPEND upload path allows an attacker who controls part of the appended message body to smuggle protocol commands into a live IMAP session when CRLF conversion is explicitly enabled (curl --crlf or CURLOPT_CRLF). Affected releases are curl and libcurl up to and including 8.22.0; the fix ships in curl 8.23.0, released alongside the project's quarterly batch of twenty-four advisories. The curl project rates this one LOW severity, the independently assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N (network reachable, no privileges required by the attacker, high attack complexity, limited integrity impact), and no public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade to curl/libcurl 8.23.0, which contains the fix; the advisory at https://curl.se/docs/security.html links the specific fixing commit for CVE-2026-87864, and the batch announcement is at https://seclists.org/oss-sec/2026/q4/154. If upgrading immediately is not possible, the most effective compensating control is to stop using CRLF conversion on IMAP APPEND uploads: remove --crlf from curl invocations and clear CURLOPT_CRLF in libcurl callers. The trade-off is that line-ending normalization is then no longer performed by curl, so applications that relied on it must sanitize and normalize the message body themselves before the APPEND, stripping or escaping CR and LF sequences that could terminate the IMAP literal, or the target server may reject messages with bare LF line endings. Where the uploaded content comes from untrusted input, validate and constrain that input at the application layer before handing it to libcurl, since that input is the second prerequisite for exploitation. As a defense-in-depth measure, run IMAP uploads with credentials scoped to only the mailboxes they need, so that any injected command executes with minimal privilege inside the session. Note that many of the twenty-four advisories in this release address connection-reuse and credential-forwarding behaviors, so a single upgrade to 8.23.0 resolves this issue together with the rest of the batch.
Affected ProductsAI
curl and libcurl are affected, specifically the shared IMAP APPEND upload code path that supports CRLF conversion. Details for the other advisories in the same curl 8.23.0 release list 8.22.0 as the last vulnerable version and the newly published release as the first fixed version; this entry follows that same release boundary, so builds up to and including 8.22.0 are exposed and 8.23.0 carries the fix. No CPE strings were included in the supplied record, and the advisory does not state the first vulnerable release for CVE-2026-87864, so no lower bound should be assumed beyond what the curl vulnerability table publishes. Vendor documentation is at https://curl.se/docs/security.html, the release announcement is the oss-security post at https://seclists.org/oss-sec/2026/q4/154, and commercial long-term-support builds are offered through https://rock-solid.curl.dev. Applications that use libcurl exclusively for HTTP, FTP, or other protocols, or that use IMAP without CRLF conversion, are not exposed to this specific flaw.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the IMAP APPEND implementation shared by the curl command-line tool and the libcurl library. CURLOPT_CRLF (exposed as the --crlf flag) asks curl to convert bare line feeds in uploaded data into CRLF pairs. In IMAP, an APPEND is framed as a command with a literal (for example '{size}') followed by the raw message body; a CRLF that is meant only as part of the message content can instead terminate the server-side parsing context and cause following bytes to be interpreted as new IMAP commands. Because the conversion is performed on data whose content may be partially attacker-controlled, an injector can shape newline sequences that survive conversion and break out of the literal framing. No CWE identifier, CPE string, EPSS score, KEV entry, or vendor CVSS vector was supplied with this record, so the root cause class is described functionally rather than by CWE number; the independent assessment places the weakness in the improper-neutralization-of-line-sequences family affecting an application-layer protocol parser. The primary mitigating design factor is that CRLF conversion is off by default and only exists when the integrating application or user explicitly requests it, which is why the curl maintainers classify this as LOW rather than HIGH.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Network-facing IMAP channel but exploitation needs non-default CRLF conversion and attacker-controlled upload content (AC:H); injection affects only IMAP command integrity (I:L), no confidentiality or availability impact.
Description PRE-NVD
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
GitHub PoC
Exploit-DB