CVE-2026-87864 curl CVE debrief

Who should care

Defenders responsible for curl deployments, particularly those using IMAP, should assess exposure and prioritize verification and potential upgrades. Operators of systems using curl with IMAP, security teams, and vulnerability management teams should review the CVE record and source item for details on the vulnerability and potential impacts. They should also verify curl versions, assess exposure, and plan for upgrades or mitigations as needed.

Why it matters

The IMAP APPEND plus CRLF conversion command injection vulnerability in curl requires defenders to assess exposure, verify versions, and potentially upgrade to a non-affected version.

• Potential command injection within authenticated IMAP sessions
• Possible exploitation of curl deployments using IMAP
• Verification of curl version and exposure is necessary
• Upgrade to a non-affected version may be required

Technical summary

Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session. This vulnerability affects curl deployments using IMAP and requires defenders to assess exposure, verify versions, and potentially upgrade to a non-affected version. The CVE record and source item provide details on the IMAP APPEND plus CRLF conversion command injection vulnerability in curl.

Defensive priority

Defenders should prioritize verifying and upgrading to a non-affected version of curl, if available, and assess exposure in their environment.

Recommended defensive actions

• Verify curl version and assess exposure
• Upgrade to a non-affected version of curl, if available
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the IMAP APPEND plus CRLF conversion command injection vulnerability in curl. However, the corpus does not establish versions, exploitation, impact, or remediation beyond affected versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.