CVE-2026-87864: curl · Improper Handling of Length Parameter Inconsistency
Affects curlSource CVE Database V5
Not known to be exploited.
Data as of 26 Oct 2026, 22:12 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Exploitation evidence
Disclosed: evidence found.
CVE published 20 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| curlcurl | Affected
| Fixed in– |
AI-suggested
Until a fix is available, avoid enabling CURLOPT_CRLF when using curl with IMAP or apply other vendor-recommended mitigations if available.
Description
CVE-2026-87864 is a vulnerability in curl where enabling CURLOPT_CRLF causes the client to advertise the raw input byte count in the IMAP APPEND literal, while transmitting data with expanded line endings. This mismatch leads the server to read only the advertised byte count, causing overflow bytes to be interpreted as additional IMAP commands within the authenticated session.