CentOS Linux 8.5 [TuxCare] Security Update: cyrus-imapd / cyrus-imapd-devel / cyrus-imapd-doc-extra / etc (CENTOS8.5:CLSA-2026:1790252040)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1790252040 advisory. - An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a...

Rocky Linux 9 [CIQ] Security Update: cyrus-imapd / cyrus-imapd-debuginfo / cyrus-imapd-debugsource / etc (crlsa-2024_9195)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20249195 advisory. cyrus-imapd: unbounded memory allocation by sending many LITERALs in a single command CVE-2024-34055 Tenable has extracted the preceding description block directly...

CentOS Linux 8 [TuxCare] Security Update: cyrus-imapd / cyrus-imapd-devel / cyrus-imapd-doc-extra / etc (CENTOS-STREAM8:CLSA-2026:1790769478)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1790769478 advisory. - An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash ...

openSUSE 16: cyradm / cyrus-imapd / cyrus-imapd-devel / cyrus-imapd-snmp / etc (openSUSE-SU-2026:21929-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21929-1 advisory. Changes in cyrus-imapd: Update to 3.8.8 bugfix release: - CVE-2026-61907: JMAP snooze bypasses destination-mailbox ACL bsc1279908 -...

Security update for cyrus-imapd (moderate)

openSUSE security update: security update for cyrus-imapd ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21929-1 Rating: moderate References: bsc1279908 bsc1279975 bsc1279976 bsc1279977 bsc1279978 bsc1279979 Cross-References: CVE-2026-61907...

[SECURITY] Fedora 43 Update: cyrus-imapd-3.10.4-1.fc43

The Cyrus IMAP Internet Message Access Protocol server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contacts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols. The Cyrus IMAP server is a scalable enterprise groupware system designed for use from...

Fedora 44 : cyrus-imapd (2026-740bc1c6fa)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-740bc1c6fa advisory. - New version 3.12.4 rhbz2500822 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...

Fedora 43 : cyrus-imapd (2026-97a7ec5786)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-97a7ec5786 advisory. - New version 3.10.4 rhbz2500822 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...

Fedora 45 : cyrus-imapd (2026-3bf3e31ef4)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3bf3e31ef4 advisory. - New version 3.12.4 rhbz2500822 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...

OPENSUSE-SU-2026:21929-1 Security update for cyrus-imapd

This update for cyrus-imapd fixes the following issues: Changes in cyrus-imapd: Update to 3.8.8 bugfix release: - CVE-2026-61907: JMAP snooze bypasses destination-mailbox ACL bsc1279908 - CVE-2026-61908: JMAP email-header blob ID out-of-bounds index bsc1279975 - CVE-2026-61909: CalDAV/CardDAV...

CVE-2026-61911

A flaw was found in cyrus-imapd. An authenticated user could install a Sieve script to determine if another user's private mailbox exists. This is achieved by observing the behavior of the fileinto branch during Local Mail Transfer Protocol LMTP delivery. Additionally, this method could allow the...

CVE-2026-61910

A flaw was found in cyrus-imapd. An authenticated user with specific permissions on another user's mailbox could alter its special-use annotation. This manipulation might allow the user to change the shared mailbox's role, potentially causing unintended mail content to be written to it and shared...

CVE-2026-61908

A flaw was found in cyrus-imapd. An authenticated user could exploit this vulnerability by attempting to download a specially crafted JMAP JSON Meta Application Protocol blob ID. This action could lead to reading beyond the intended memory boundary, potentially exposing sensitive information from...

CVE-2026-61915

A flaw was found in cyrus-imapd. An authenticated calendar user could trigger a double-free vulnerability in the Cyrus CalDAV worker. By sending a specially crafted PATCH request that includes PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind, the memor...

CVE-2026-61909

A flaw was found in cyrus-imapd. An authenticated DAV Distributed Authoring and Versioning user with some shared access to another user's calendar or address book could read unshared events or contacts. This information disclosure occurs by including specific resource identifiers in a...

[SECURITY] [DLA 4766-1] cyrus-imapd security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4766-1 [email protected] https://www.debian.org/lts/security/ Xavier Guimard September 01, 2026 https://wiki.debian.org/LTS -...

Debian dla-4766 : cyrus-admin - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4766 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4766-1 [email protected]...

CVE-2026-67194

Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser allocsearchkey in searchinfo.C recursively descends on nested parenthesized groups through a mutual...

PT-2026-65858

Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser alloc search key in searchinfo.C recursively descends on nested parenthesized groups through a mutual...

openSUSE 16: cyradm / cyrus-imapd / cyrus-imapd-devel / cyrus-imapd-snmp / etc (openSUSE-SU-2026:21368-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21368-1 advisory. Changes in cyrus-imapd: - Update to 3.8.7 bugfix release - CVE-2026-47081: XAPPLEPUSHSERVICE folder existence oracle and push hijack bsc1271617 ...