Vulnerabilities

TI-2026-44296 CVE-2026-61915 · GHSA-jxhj-wr2q-m255

Double free in cyrusimap Cyrus IMAP

LOW 31

An issue was discovered in Cyrus IMAP before 3.12.4.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00259 Published 2026-09-09 Partial fix · 3.8.8, 3.10.4 +1 CWE-415

TI-2026-44295 CVE-2026-61911 · GHSA-v69j-37vj-46wc

An issue was discovered in Cyrus IMAP before 3.12.4.

LOW 19

An issue was discovered in Cyrus IMAP before 3.12.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00218 Published 2026-09-09 Partial fix · 3.8.8, 3.10.4 +1 CWE-497

TI-2026-44294 CVE-2026-61910 · GHSA-4rv6-f2p6-rhx5

Incorrect authorization in cyrusimap Cyrus IMAP

LOW 22

An issue was discovered in Cyrus IMAP before 3.12.4.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.0019 Published 2026-09-09 Partial fix · 3.8.8, 3.10.4 +1 CWE-863

TI-2026-44293 CVE-2026-61909 · GHSA-q4vc-r364-vq8w

An issue was discovered in Cyrus IMAP before 3.12.4.

LOW 19

An issue was discovered in Cyrus IMAP before 3.12.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00204 Published 2026-09-09 Partial fix · 3.8.8, 3.10.4 +1 CWE-420

TI-2026-44292 CVE-2026-61908 · GHSA-2x93-wv63-897r

Out-of-bounds read in cyrusimap Cyrus IMAP

LOW 28

An issue was discovered in Cyrus IMAP before 3.12.4.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00224 Published 2026-09-09 Partial fix · 3.8.8, 3.10.4 +1 CWE-125

TI-2021-12968 CVE-2021-33582 · GHSA-prxx-4m38-9m83

Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service…

LOW 38

Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03095 Published 2021-09-01 Partial fix CWE-407

TI-2021-12021 CVE-2021-32056 · GHSA-v3j8-2g92-h2q8

Cyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1, allows remote authenticated…

LOW 23

Cyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1, allows remote authenticated users to bypass intended access restrictions on server annotations and consequently cause replication to stall.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.017 Published 2021-05-10 Will not fix CWE-732

TI-2019-14256 CVE-2019-19783 · GHSA-rv2p-w5h4-rfg3

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x…

LOW 32

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01655 Published 2019-12-16 Partial fix CWE-269

TI-2019-13644 CVE-2019-18928 · GHSA-mpmx-j2j3-253q

Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because…

MEDIUM 47

Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connec…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02392 Published 2019-11-15 Fixed

TI-2019-08479 CVE-2019-11356 · GHSA-v5c4-xfxj-8x84

The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9…

MEDIUM 52

The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.07622 Published 2019-06-03 Fixed CWE-787

TI-2017-10361 CVE-2017-14230 · GHSA-ghq8-mj24-5v6f

In the mboxlist_do_find function in imap/mboxlist.c in Cyrus IMAP before 3.0.4, an…

MEDIUM 43

In the mboxlist_do_find function in imap/mboxlist.c in Cyrus IMAP before 3.0.4, an off-by-one error in prefix calculation for the LIST command caused use of uninitialized memory, which might allow remote attackers to obt…

CVSS 3.0CRITICAL 9.1 Network No auth No interaction EPSS 0.02177 Published 2017-09-10 No fix listed CWE-20

TI-2015-06721 CVE-2015-8078 · GHSA-5pfc-g3f2-6263

Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19…

LOW 38

Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the section_offs…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02753 Published 2015-12-03 No fix listed CWE-189

TI-2015-06720 CVE-2015-8077 · GHSA-gjf9-hv65-fr5w

Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19…

LOW 39

Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the start_octet…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03261 Published 2015-12-03 No fix listed CWE-189

TI-2015-06719 CVE-2015-8076 · GHSA-fxwg-gpw8-9wrp

The index_urlfetch function in index.c in Cyrus IMAP 2.3.x before 2.3.19, 2.4.x before…

LOW 39

The index_urlfetch function in index.c in Cyrus IMAP 2.3.x before 2.3.19, 2.4.x before 2.4.18, 2.5.x before 2.5.4 allows remote attackers to obtain sensitive information or possibly have unspecified other impact via vect…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03261 Published 2015-12-03 Will not fix CWE-119

Vulnerabilities

Filters