ALPINE-CVE-2026-87864

ALPINE-CVE-2026-87864

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.

Fix available

Published

2026-10-20T21:17:20.497Z

Updated

2026-10-25T16:30:03.601148393Z

Stack: system

Check your server →