From aa65a60fc7bcef4152152cf5a4e87f04cad54368 Mon Sep 17 00:00:00 2001
From: Sergey Kandaurov <pluknet@nginx.com>
Date: Fri, 27 Feb 2026 21:18:16 +0400
Subject: [PATCH] Mail: stricter IMAP literals validation.

As clarified in RFC 3501, Section 7.5, literals are followed
either by SP, for additional command arguments, or CRLF.
---
 src/mail/ngx_mail_parse.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/src/mail/ngx_mail_parse.c b/src/mail/ngx_mail_parse.c
index 4db1f18d3..a694bf6b6 100644
--- a/src/mail/ngx_mail_parse.c
+++ b/src/mail/ngx_mail_parse.c
@@ -598,20 +598,16 @@ ngx_mail_imap_parse_command(ngx_mail_session_t *s)
 
         case sw_end_literal_argument:
             switch (ch) {
-            case '{':
-                if (s->args.nelts <= 2) {
-                    state = sw_literal;
-                    break;
-                }
-                goto invalid;
+            case ' ':
+                state = sw_spaces_before_argument;
+                break;
             case CR:
                 state = sw_almost_done;
                 break;
             case LF:
                 goto done;
             default:
-                state = sw_spaces_before_argument;
-                break;
+                goto invalid;
             }
             break;