CentOS Linux 8 [TuxCare] Security Update: cyrus-imapd / cyrus-imapd-devel / cyrus-imapd-doc-extra / etc (CENTOS-STREAM8:CLSA-2026:1790769478)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1790769478 advisory. - An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash ...

CVE-2026-61915

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding th...

DEBIAN-CVE-2026-61915

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding th...

CVE-2026-61915

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding th...

PT-2026-89142

Name of the Vulnerable Software and Affected Versions Cyrus IMAP versions prior to 3.12.4 Description A double-free issue exists in the VPATCH BYPARAM functionality. An authenticated calendar user can cause a Cyrus CalDAV worker to crash by sending a PATCH request containing...

CVE-2026-61915

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding th...

CVE-2026-61915

Cyrus IMAP before 3.12.4 is affected by a VPATCH BYPARAM double-free in the CalDAV worker. An authenticated calendar user can trigger a crash by sending a PATCH request with PATCH-ACTION="BYPARAM@..." against a resource that has two or more properties of the matched kind, causing the memory holdi...

CVE-2026-61915

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding th...

EUVD-2026-75168

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding th...