CVE-2026-67194
Courier IMAP < 6.0.1 Mail Server < 2.0.2 Stack Overflow DoS via Nested SEARCH Queries
- State
- Published
- Severity
- 7.1 High
- Published
- Jul 29, 2026
- Updated
- Aug 14, 2026
- Reserved
- Jul 28, 2026
Description
Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser (alloc_search_key in searchinfo.C) recursively descends on nested parenthesized groups through a mutual recursion chain with alloc_search_andlist() and alloc_search_notkey(), with no depth limit. Courier IMAP has no overall command line length limit, making exploitation trivial. A single IMAP command with ~2500 nested parentheses overflows the 8MB default stack, causing SIGSEGV.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-674 Uncontrolled Recursion
Affected Products
| Product | Versions |
|---|---|
Courier IMAPsvarshavchik |
|
Courier Mail Serversvarshavchik |
|
References
- Courier IMAP Release Notesrelease-notes
- Courier Mail Server Release Notesrelease-notes
- Patch Commitpatch
- Debian Packageproduct
- https://www.vulncheck.com/advisories/courier-imap-mail-server-stack-overflow-dos-via-nested-search-queriesthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.