CVE-2026-87864
NONE—CVSS v3
—CVSS v2
0.21%
EPSS (exploit probability)
—CWE
Description
Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in
the `IMAP APPEND {N}` literal while transmitting line-ending expanded data.
The server reads only $N$ bytes for the payload, causing the remaining
overflow bytes to be interpreted and executed as pipelined IMAP commands
within the authenticated session.
Affected routers (0)
No routers currently mapped to this CVE in our database.