EUVD-2026-50414
GHSA-mcmr-g7gg-p242
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable IMAP with low complexity, but a valid mailbox login is required (PR:L); impact is availability-only DoS, so C:N/I:N/A:H.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
4DescriptionCVE.org
Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser (alloc_search_key in searchinfo.C) recursively descends on nested parenthesized groups through a mutual recursion chain with alloc_search_andlist() and alloc_search_notkey(), with no depth limit. Courier IMAP has no overall command line length limit, making exploitation trivial. A single IMAP command with ~2500 nested parentheses overflows the 8MB default stack, causing SIGSEGV.
AnalysisAI
Denial of service in Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 lets any authenticated IMAP user crash the imapd process by sending a single SEARCH command containing deeply nested parenthesized groups. Because the SEARCH parser recurses without a depth limit and Courier enforces no command-line length cap, roughly 2500 nested parentheses exhaust the 8MB default stack and trigger a SIGSEGV. There is no public exploit identified at time of analysis, but the vendor commit and advisory describe exploitation as trivial, and it affects availability only (no data exposure or code execution).
Technical ContextAI
Courier IMAP is an open-source IMAP/POP mail server component of the Courier Mail Server suite. The flaw is a classic CWE-674 (Uncontrolled Recursion) stack exhaustion: alloc_search_key() in imap/searchinfo.C descends recursively on each nested parenthesized group, forming a mutual-recursion chain with alloc_search_andlist() and alloc_search_notkey(). With no recursion depth limit and no overall IMAP command-line length limit, each level of nesting consumes a stack frame until the process's 8MB default thread stack overflows. The vendor fix (commit b5b5581) introduces hard caps: a per-parse counter that returns an error past 1000 nested constructs, a searchlist size guard that throws past 1000 entries, and try/catch guards around alloc_parsesearch() in imapd.C and smap.C so the parser returns a protocol error instead of crashing.
RemediationAI
Vendor-released patch: upgrade Courier IMAP to 6.0.1 or Courier Mail Server to 2.0.2, both of which add hard caps (max ~1000 nested search constructs) that return an IMAP protocol error instead of exhausting the stack - this is the primary and complete fix (see the release tags and commit b5b5581 referenced above, and the VulnCheck advisory at https://www.vulncheck.com/advisories/courier-imap-mail-server-stack-overflow-dos-via-nested-search-queries). If immediate patching is not possible, compensating controls include restricting IMAP access to trusted networks or VPN so that only known accounts can reach imapd, tightening account provisioning to reduce the pool of authenticated users who could abuse SEARCH, placing an IMAP-aware proxy or filter in front of imapd to reject abnormally long or deeply parenthesized SEARCH command lines, and configuring the service manager to auto-restart imapd on crash to limit outage duration - noting that restart-based recovery does not stop repeated abuse and network restriction reduces legitimate remote access.
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today