Skip to main content

Cyrus IMAP CVE-2026-61915

| EUVDEUVD-2026-75168 HIGH
Double Free (CWE-415)
2026-09-09 cve@mitre.org GHSA-jxhj-wr2q-m255
Denial Of Service Imap Cyrus
7.1
CVSS 3.1 · NVD
Share

Severity by source

Vendor (mitre) PRIMARY
MEDIUM
qualitative
NVD
7.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
vuln.today AI
6.5 MEDIUM

Network-reachable but needs an authenticated calendar user (PR:L); double-free yields a worker crash, so A:H with no confidentiality and no meaningful integrity impact (I:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High

Lifecycle Timeline

6
Analysis Updated
Sep 16, 2026 - 15:42 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Sep 16, 2026 - 15:37 vuln.today
cvss_changed
Severity Changed
Sep 16, 2026 - 15:37 NVD
MEDIUM HIGH
CVSS changed
Sep 16, 2026 - 15:37 NVD
4.2 (MEDIUM) 7.1 (HIGH)
Patch available
Sep 09, 2026 - 21:19 EUVD
Analysis Generated
Sep 09, 2026 - 20:39 vuln.today

DescriptionNVD

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties.

AnalysisAI

A double-free in the CalDAV calendar worker of Cyrus IMAP before 3.12.4 lets an authenticated calendar user crash that worker by sending a WebDAV PATCH request carrying PATCH-ACTION="BYPARAM@..." against a calendar resource that holds two or more properties of the matched kind. The vulnerability is reachable only with valid credentials and with the CalDAV/calendar component enabled (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H, CWE-415), and the assessed outcome is a worker crash/restart rather than data disclosure or code execution. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires an authenticated Cyrus IMAP calendar user (PR:L) with the ability to send CalDAV PATCH requests to the server. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine but bounded availability issue, not a critical priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patch: upgrade to Cyrus IMAP 3.12.4 (3.11.x and later), 3.10.4 (3.9.x/3.10.x) or 3.8.8 (3.8.x and earlier), per the release notes linked above. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Cyrus IMAP instances and confirm which are running versions earlier than 3.12.4, and determine whether the CalDAV/calendar component is enabled on each, since that is a precondition for exploitation; where calendar services are not exposed to untrusted or broad user populations, immediate pressure is low. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Imap

View all
CVE-2019-18928 CRITICAL
9.8 Nov 15

Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpre
CVE-2019-11356 CRITICAL
9.8 Jun 03

The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execut
CVE-2017-14230 CRITICAL
9.1 Sep 10

In the mboxlist_do_find function in imap/mboxlist.c in Cyrus IMAP before 3.0.4, an off-by-one error in prefix calculatio
CVE-2015-8077 HIGH
7.5 Dec 03

Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote at
CVE-2015-8076 HIGH
7.5 Dec 03

The index_urlfetch function in index.c in Cyrus IMAP 2.3.x before 2.3.19, 2.4.x before 2.4.18, 2.5.x before 2.5.4 allows
CVE-2015-8078 HIGH
7.5 Dec 03

Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote at
CVE-2021-33582 HIGH
7.5 Sep 01

Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input tha
CVE-2026-61908 MEDIUM
6.5 Sep 09

Heap memory disclosure in Cyrus IMAP before 3.12.4 allows authenticated users to leak adjacent heap contents via a craft
CVE-2019-19783 MEDIUM
6.5 Dec 16

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. Rated medium severity
CVE-2026-61910 MEDIUM
5.0 Sep 09

Cyrus IMAP before 3.12.4 permits an authenticated sharee who holds the `maySetKeywords` ACL right on a shared mailbox to
CVE-2026-61911 MEDIUM
4.3 Sep 09

Cyrus IMAP before 3.12.4 exposes a Sieve-based mailbox existence oracle that allows authenticated users to enumerate pri
CVE-2026-61909 MEDIUM
4.3 Sep 09

Cyrus IMAP before 3.12.4 exposes private calendar events and contacts to partially-privileged authenticated users throug

Same weakness CWE-415 – Double Free

View all
CVE-2014-0502 HIGH POC
8.8
CVE-2018-0101 CRITICAL POC
10.0
CVE-2023-25136 MEDIUM POC
6.5
CVE-2026-33824 CRITICAL POC
9.8
CVE-2014-1767 HIGH POC
7.2
CVE-2016-5768 CRITICAL POC
9.8
CVE-2016-5772 CRITICAL POC
9.8
CVE-2016-3132 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-61915 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy