CVE-2026-87864

CVE-2026-87864

published October 21, 2026

CVSS
—
EPSS
0%
Percentile
10.2
In the wild
Unconfirmed
What it is

Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in

the `IMAP APPEND {N}` literal while transmitting line-ending expanded data.

The server reads only $N$ bytes for the payload, causing the remaining

overflow bytes to be interpreted and executed as pipelined IMAP commands

within the authenticated session.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00206 · 10.2th percentile
Published
2026-10-21T01:17Z
References (3)
EPSS history
Timeline
  • 22 OCT 03:36Z
    EPSS moved — → 0%
    epss
  • 20 OCT 20:13Z
    IMAP APPEND plus CRLF conversion command injection
    cvelistv5
  • 20 OCT 20:13Z
    IMAP APPEND plus CRLF conversion command injection
    cvelistv5