Enabling CURLOPT_CRLF causes curl to advertise the raw input byte count in the IMAP APPEND {N} literal while transmitting line-ending expanded data. (CVE-2026-87864)

This vulnerability arises when curl's CURLOPT_CRLF option is enabled. Curl advertises the raw byte count of the input in the IMAP APPEND {N} literal, but due to line-ending expansion during transmission, the actual data sent is longer than N bytes. The IMAP server reads only N bytes as the payload, causing the extra bytes to be treated as subsequent IMAP commands. This can lead to unintended command execution within the authenticated IMAP session.

An attacker able to influence the transmitted data could exploit this discrepancy to inject and execute additional IMAP commands beyond the intended payload. This could potentially lead to unauthorized actions within the authenticated IMAP session. However, no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid enabling CURLOPT_CRLF when using curl with IMAP APPEND commands to prevent this issue.