Enabling CURLOPT_CRLF causes curl to advertise the raw input byte count in the IMAP APPEND {N} literal while transmitting line‑ending expanded data. Because the server reads only the announced N bytes as the payload, the remaining overflow bytes are interpreted as additional IMAP commands and executed within the authenticated session. This boundary error (CWE-130) allows an attacker who can control the payload to inject and run arbitrary IMAP commands, potentially compromising the affected system.

The vulnerability affects any installation of curl that performs CRLF conversion during IMAP APPEND. No official version range is provided; therefore, all versions that enable this feature are potentially impacted until an updated release is applied.

The CVSS score of 3.7 indicates a moderate severity, and the absence of an EPSS score and its exclusion from the KEV catalog suggest it is not widely regarded as a high‑risk exploit. Nevertheless, an attacker who can craft IMAP message data is likely to succeed on a server that accepts the size advertised by curl, meaning that internal or compromised networks where curl is used to submit IMAP data could be vulnerable.