CVE-2026-61908

Cyrus IMAP before 3.12.4 (also patched in 3.8.8 and 3.10.4) is affected by an out-of-bounds read in its JMAP email-header blob ID handling. An authenticated user can craft a JMAP blob ID of the form H- referencing an index beyond the bounds of the internal blob_headers array , causing a read past...

EUVD-2026-75134

An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H-, which could read past the end of the internal blobheaders array during download, exposing...