VDB
CVE-2026-87864
CVE-2026-87864
PUBLISHED
Reported by curl · Published October 20, 2026
Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.
EPSS 0.22% · 12.6th percentile
Risk Scores
EPSS Score
0.22%
12.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| curl | curl | 8.21.0, 8.20.0, 8.19.0 |
| alpine | curl | 0 |
| curl | curl | 8.21.0, 8.20.0, 8.19.0 |
Timeline
- CVE Published
- Oct 14, 2026 PoC Published
- Oct 17, 2026 PoC Published
- Oct 19, 2026 PoC Published
- Oct 19, 2026 PoC Published
- Oct 21, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 27, 2026 EPSS Score