Cyrus IMAP CVE-2026-61915

Requires an authenticated Cyrus IMAP calendar user (PR:L) with the ability to send CalDAV PATCH requests to the server. The specific trigger is a PATCH containing PATCH-ACTION="BYPARAM@..." (VPATCH BYPARAM processing) directed at a calendar resource that holds two or more properties of the matched kind - the double-free only occurs when multiple matching properties exist to iterate over. Limiting factors: valid credentials are mandatory (no anonymous access), the CalDAV/calendar feature must be enabled and in use, and the affected component is the CalDAV worker specifically. Impact is limited to a worker crash (denial of service); no data disclosure results.

This is a genuine but bounded availability issue, not a critical priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) shows network-reachable, low-complexity exploitation but requires an authenticated calendar user (PR:L), and the real impact is a crashed CalDAV worker (A:H) with no confidentiality loss (C:N) and only nominal integrity effect (I:L). All exploitation signals point away from urgency: EPSS is 0.22% (12th percentile), the CVE is NOT in CISA KEV, no public POC is identified, and CISA SSVC scores Exploitation=none, Automatable=no, Technical Impact=partial. The signals are internally consistent - a low-privilege authenticated denial-of-service against a niche protocol handler, which is exactly the kind of high-ish CVSS (7.1) but low real-world-risk issue that should be patched during normal maintenance rather than treated as an emergency. One note: as a CWE-415 double-free, memory corruption can in principle escalate beyond a clean crash, but the description and A:H-dominant scoring frame it strictly as a worker crash (DoS), and no evidence of code-execution potential is provided.

An attacker who already holds valid credentials on the Cyrus CalDAV service (any authenticated calendar user) crafts a PATCH request carrying PATCH-ACTION="BYPARAM@..." targeting a calendar resource that has two or more properties of the matched kind. Iterating over those properties frees the selector memory more than once, triggering a double-free that crashes the CalDAV worker. No public exploit code is identified at time of analysis, and the low attack complexity means repeated requests could sustain a denial of service against calendar functionality.