Tools AI-Found Vulnerability Register aifv-0103
Register entry
curl: IMAP APPEND plus CRLF conversion command injection
- CVE
- CVE-2026-87864
- Project
- curl
- Component
- curl and libcurl
- Finder
- AISLE
- Autonomy
- AI-assisted audit with human report review, according to AISLE
- Evidence tier
- Claim outside the record
- Assigner
- curl
- Severity
- Low (curl vendor rating)
- Confidence
- SINGLE
What happened
IMAP upload length and line-ending conversion could disagree, allowing remaining bytes to be interpreted as commands. curl rates the issue Low.
Credit as recorded: Stanislav Fort (Aisle Research). The vendor credits Stanislav Fort (Aisle Research). The first fixed main release was 8.22.0 on 2 September 2026; public disclosure followed on 14 October. AISLE attributes the finding to its AI-assisted audit. The vendor advisory names the human researcher, so machine involvement is recorded as an external claim. Date basis: vendor advisory publication.
Sources
- curl vendor advisorycurl.se/docs/CVE-2026-87864.html
- AISLE account of the auditaisle.com/blog/one-aisle-curl-audit-produced-24-cves-18-ship…
One record from the AI-Found Vulnerability Register, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 28 October 2026