PT-2026-65858 · Svarshavchik · Courier-Imap+1

Tristan Madani · CVE-2026-67194 · Publicado 2026-07-29 · Atualizado 2026-07-29

Mitre

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser (alloc search key in searchinfo.C) recursively descends on nested parenthesized groups through a mutual recursion chain with alloc search andlist() and alloc search notkey(), with no depth limit. Courier IMAP has no overall command line length limit, making exploitation trivial. A single IMAP command with ~2500 nested parentheses overflows the 8MB default stack, causing SIGSEGV.

Correção

Uncontrolled Recursion

Enumeração de Fraquezas

CWE-674

Identificadores relacionados

CVE-2026-67194

Produtos afetados

Courier-Imap

Courier Mail Server

Referências · 6

• https://github.com/svarshavchik/courier/releases/tag/courier%2F2.0.2%2F20260627214309 · Nota
• https://github.com/svarshavchik/courier/releases/tag/courier-imap%2F6.0.1%2F20260627214444 · Nota
• https://github.com/svarshavchik/courier-libs/commit/b5b5581aabea3efadf5e2944947ff0214aa3533e · Correção
• https://packages.debian.org/sid/courier-imap · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-67194 · Nota de Segurança
• https://vulncheck.com/advisories/courier-imap-mail-server-stack-overflow-dos-via-nested-search-queries · Nota