IMAP connection reuse runs requests in the wrong case-sensitive mailbox

How it was found

When libcurl reuses an authenticated IMAP connection, lib/imap.c:2071-2089 uses curl_strequal() to decide whether the requested mailbox is already selected. RFC 9051 section 5.1 requires clients to work with servers where non-INBOX mailbox names are case-sensitive, while only INBOX is guaranteed to be case-insensitive. On curl 8.21.0 commit 68720b4837284335b2d63cb358f8f6ce65f5bc55 and current master 0ebe0e978535f10f6fe54536ca2e2e6b304a4d5a, sequential requests for Private and private reuse one TCP connection, omit SELECT private, and return PRIVATE_MAILBOX_CANARY for the second request instead of the lowercase mailbox's data. With two separate easy handles sharing one multi connection pool, a second request using UID STORE 1 +FLAGS (\Flagged) also skips SELECT private and changes the flag on the canary in Private; the fixed control selects private first and changes only the lowercase canary. The attachment reproduces the read and STORE cases twice on both revisions, includes distinct-name, exact-same-name, INBOX, and fixed controls, and I used AI to assist the report drafting before personally rerunning every case.

Impact

In a service that pools libcurl IMAP requests under one shared account, an attacker able to request a case-colliding mailbox can read message data from, or change message flags in, the mailbox left selected by a previous request, crossing the application's mailbox boundary.