PT-2026-65858 · Svarshavchik · Courier-Imap+1

Tristan Madani · CVE-2026-67194 · Published 2026-07-29 · Updated 2026-07-29

Mitre

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser (alloc search key in searchinfo.C) recursively descends on nested parenthesized groups through a mutual recursion chain with alloc search andlist() and alloc search notkey(), with no depth limit. Courier IMAP has no overall command line length limit, making exploitation trivial. A single IMAP command with ~2500 nested parentheses overflows the 8MB default stack, causing SIGSEGV.

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2026-67194

Affected Products

Courier-Imap

Courier Mail Server

References · 6

• https://github.com/svarshavchik/courier-libs/commit/b5b5581aabea3efadf5e2944947ff0214aa3533e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-67194 · Security Note
• https://github.com/svarshavchik/courier/releases/tag/courier%2F2.0.2%2F20260627214309 · Note
• https://github.com/svarshavchik/courier/releases/tag/courier-imap%2F6.0.1%2F20260627214444 · Note
• https://packages.debian.org/sid/courier-imap · Note
• https://vulncheck.com/advisories/courier-imap-mail-server-stack-overflow-dos-via-nested-search-queries · Note