CVE-2026-87864

A flaw was found in curl. When curl is configured to perform carriage return and line feed (CRLF) conversion during an Internet Message Access Protocol (IMAP) append operation, it incorrectly reports the raw input size rather than the expanded byte count. Because the receiving server only reads the advertised length as message data, it interprets the remaining overflow bytes as subsequent commands. An attacker capable of supplying message data with line breaks can exploit this issue to execute unauthorized IMAP commands within an authenticated session.

Red Hat has evaluated this vulnerability as Low impact because exploitation demands an atypical configuration combining IMAP message uploads with explicit line-ending conversions. Furthermore, a malicious actor must have the ability to supply crafted message content within an established, authenticated mailbox session to trigger command pipelining. In standard Red Hat Enterprise Linux environments, libcurl client applications do not enable CRLF conversion by default, significantly constraining the practical attack surface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.