CLSA-2026-1792122518 Update of cyrus-imapd

fix NULL dereference in CalDAV VPATCH PATCHACTION string matching that crashed the httpd worker on a property with an empty value...

[SECURITY] Fedora 45 Update: cyrus-imapd-3.12.4-2.fc45

The Cyrus IMAP Internet Message Access Protocol server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contacts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols. The Cyrus IMAP server is a scalable enterprise groupware system designed for use from...

CLSA-2026-1790974923 cyrus-imapd: Fix of 2 CVEs

fix CVE-2026-61911: Sieve mailboxexists/metadata tests ignored the lookup ACL on another user's mailbox - fix CVE-2026-61909: CalDAV/CardDAV multiget did not check the ACL of each requested href...

CLSA-2026-1790963865 cyrus-imapd: Fix of CVE-2026-61915

fix CVE-2026-61915: double-free in the CalDAV VPATCH BYPARAM selector - do not free VPATCH parameters already removed by reference, which aborted the CalDAV worker before the CVE-2026-61915 path was reached - add the upstream cunit regression test for CVE-2026-61915...

Rocky Linux 9 [CIQ] Security Update: cyrus-imapd / cyrus-imapd-debuginfo / cyrus-imapd-debugsource / etc (crlsa-2024_9195)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20249195 advisory. cyrus-imapd: unbounded memory allocation by sending many LITERALs in a single command CVE-2024-34055 Tenable has extracted the preceding description block directly...

CentOS Linux 8.5 [TuxCare] Security Update: cyrus-imapd / cyrus-imapd-devel / cyrus-imapd-doc-extra / etc (CENTOS8.5:CLSA-2026:1790252040)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1790252040 advisory. - An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a...

Rocky Linux 8 [CIQ] Security Update: cyrus-imapd / cyrus-imapd-debuginfo / cyrus-imapd-debugsource / etc (crlsa-2021_3492)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20213492 advisory. cyrus-imapd: Denial of service via string hashing algorithm collisions CVE-2021-33582 Tenable has extracted the preceding description block directly from the CIQ...

CLSA-2026-1790640190 cyrus-imapd: Fix of CVE-2021-33582

Fix CVE-2021-33582 - Denial of service via string hashing algorithm collisions...

CLSA-2026-1790769478 cyrus-imapd: Fix of CVE-2026-61915

fix CVE-2026-61915: double-free in the CalDAV VPATCH BYPARAM selector, reachable by an authenticated calendar user patching a resource with two or more properties of the matched kind - disable the cassandane test runner by default: its harness imaptest plus the perl test modules is absent from...

CLSA-2026-1790764490 cyrus-imapd: Fix of CVE-2026-61915

use strcmpsafe/strncmpsafe for VPATCH PATCHACTION string matching: icalpropertygetvalueasstring returns NULL for a property parsed with an empty value, so a VPATCH carrying 'SUMMARY;PATCH-ACTION=BYVALUE:' crashed the httpd worker on the same authenticated CalDAV path as CVE-2026-61915...

CLSA-2026-1790764098 cyrus-imapd: Fix of CVE-2026-61915

use strcmpsafe/strncmpsafe for VPATCH PATCHACTION string matching: icalpropertygetvalueasstring returns NULL for a property parsed with an empty value, so a VPATCH carrying 'SUMMARY;PATCH-ACTION=BYVALUE:' crashed the httpd worker on the same authenticated CalDAV path as CVE-2026-61915...

CLSA-2026-1790758129 cyrus-imapd: Fix of CVE-2026-61915

fix CVE-2026-61915: double-free in the CalDAV VPATCH BYPARAM selector, reachable by an authenticated calendar user patching a resource with two or more properties of the matched kind - do not free VPATCH parameters already removed by reference: the parameter stays owned by libical after...

CentOS Linux 8 [TuxCare] Security Update: cyrus-imapd / cyrus-imapd-devel / cyrus-imapd-doc-extra / etc (CENTOS-STREAM8:CLSA-2026:1790769478)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1790769478 advisory. - An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash ...

openSUSE 16: cyradm / cyrus-imapd / cyrus-imapd-devel / cyrus-imapd-snmp / etc (openSUSE-SU-2026:21929-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21929-1 advisory. Changes in cyrus-imapd: Update to 3.8.8 bugfix release: - CVE-2026-61907: JMAP snooze bypasses destination-mailbox ACL bsc1279908 -...

CLSA-2026-1790252040 cyrus-imapd: Fix of CVE-2026-61915

fix CVE-2026-61915: double-free in the CalDAV VPATCH BYPARAM selector, reachable by an authenticated calendar user patching a resource with two or more properties of the matched kind - disable the cassandane test runner by default: its harness imaptest plus the perl test modules is absent from...

Security update for cyrus-imapd (moderate)

openSUSE security update: security update for cyrus-imapd ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21929-1 Rating: moderate References: bsc1279908 bsc1279975 bsc1279976 bsc1279977 bsc1279978 bsc1279979 Cross-References: CVE-2026-61907...

CLSA-2026-1790173408 cyrus-imapd: Fix of 3 CVEs

fix CVE-2026-61915: double-free in the CalDAV VPATCH BYPARAM selector - fix CVE-2026-61909: calendar/addressbook-multiget returned resources the user has no ACL on - fix CVE-2026-61911: Sieve mailboxexists/metadata probed other users' mailboxes without a lookup-rights check - do not free VPATCH...

[SECURITY] Fedora 43 Update: cyrus-imapd-3.10.4-1.fc43

The Cyrus IMAP Internet Message Access Protocol server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contacts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols. The Cyrus IMAP server is a scalable enterprise groupware system designed for use from...

Fedora 43 : cyrus-imapd (2026-97a7ec5786)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-97a7ec5786 advisory. - New version 3.10.4 rhbz2500822 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...

Fedora 44 : cyrus-imapd (2026-740bc1c6fa)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-740bc1c6fa advisory. - New version 3.12.4 rhbz2500822 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...