CVE-2021-33582

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-407

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cyrus.topicbox.com/groups/announce/T3dde0a2352462975-M1386fc44adf967e072f8df13/cyrus-imap-3-4-2-3-2-8-and-3-0-16-releasedPatch, Vendor Advisory
https://github.com/cyrusimap/cyrus-imapd/commits/masterPatch, Third Party Advisory
https://github.com/cyrusimap/cyrus-imapd/security/advisoriesNot Applicable, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/06/msg00013.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HEO3RURJW6NLIXS7NK5PVU6MGHC4SCM/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJZB45QBUN7CZFGOWCZYUYACNBTX7LVS/
https://www.cyrusimap.org/imap/download/release-notes/index.htmlPatch, Release Notes, Vendor Advisory
https://cyrus.topicbox.com/groups/announce/T3dde0a2352462975-M1386fc44adf967e072f8df13/cyrus-imap-3-4-2-3-2-8-and-3-0-16-releasedPatch, Vendor Advisory
https://github.com/cyrusimap/cyrus-imapd/commits/masterPatch, Third Party Advisory
https://github.com/cyrusimap/cyrus-imapd/security/advisoriesNot Applicable, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/06/msg00013.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HEO3RURJW6NLIXS7NK5PVU6MGHC4SCM/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJZB45QBUN7CZFGOWCZYUYACNBTX7LVS/
https://www.cyrusimap.org/imap/download/release-notes/index.htmlPatch, Release Notes, Vendor Advisory

Timeline

Published: Sep 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-335839.8REINER timeCard 6.05.07 installs a Microsoft SQL Server with an sa password that is hardcoded in the TCServer.jar file.CVE-2021-335864.3InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "m CVE-2021-335877.5The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size CVE-2021-335897.5Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than on the tin of CVE-2021-335909.8GattLib 0.3-rc1 has a stack-based buffer over-read in get_device_path_from_mac in dbus/gattlib.c.CVE-2021-335918.8An exposed remote debugging port in Naver Comic Viewer prior to 1.0.15.0 allowed a remote attacker to execute arbitrary code via a crafted H CVE-2021-335929.8NAVER Toolbar before 4.0.30.323 allows remote attackers to execute arbitrary code via a crafted upgrade.xml file. Special characters in file CVE-2021-335935.3Whale browser for iOS before 1.14.0 has an inconsistent user interface issue that allows an attacker to obfuscate the address bar which may CVE-2021-335943.5An address bar spoofing vulnerability was discovered in Safe Browser for Android. When user clicks on a specially crafted a malicious URL, i CVE-2021-335953.5A address bar spoofing vulnerability was discovered in Safe Browser for iOS. Showing the legitimate URL in the address bar while loading the CVE-2021-335964.1Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believe that the content is s CVE-2021-335975.5A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the SAVAPI component used in certain F-Secure products can