TI-2026-47517 Aliases CVE-2026-67194 GHSA-mcmr-g7gg-p242

Courier IMAP < 6.0.1 Mail Server < 2.0.2 Stack Overflow DoS via Nested SEARCH Queries

LOW 32CWE-674Published 2026-07-29 · Updated 2026-11-08

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-674.

Summary

Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser (alloc_search_key in searchinfo.C) recursively descends on nested parenthesized groups through a mutual recursion chain with alloc_search_andlist() and alloc_search_notkey(), with no depth limit. Courier IMAP has no overall command line length limit, making exploitation trivial. A single IMAP command with ~2500 nested parentheses overflows the 8MB default stack, causing SIGSEGV.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00548 46th percentileScored 2026-11-07

Fix Fixed Courier IMAP (svarshavchik): 6.0.1Courier Mail Server (svarshavchik): 2.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
svarshavchik	Courier IMAP	before 6.0.1	6.0.1	Patch available	CNA
svarshavchik	Courier Mail Server	before 2.0.2	2.0.2	Patch available	CNA

Courier IMAP Vendorsvarshavchik Affected before 6.0.1 Fixed in 6.0.1 Patch available CNA
Courier Mail Server Vendorsvarshavchik Affected before 2.0.2 Fixed in 2.0.2 Patch available CNA

Remediation

Fix · CNA Courier IMAP (svarshavchik) Fixed in 6.0.1
Fix · CNA Courier Mail Server (svarshavchik) Fixed in 2.0.2

Timeline

2026-10-02 Threatist record created from CVE-2026-67194
2026-10-03 Alias added: GHSA-mcmr-g7gg-p242

References

Patch 1

Patch Commit

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences