CVE-2026-67194

MediumCVSS 6.5/10Last modified Jul 30, 2026

Description

Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser (alloc_search_key in searchinfo.C) recursively descends on nested parenthesized groups through a mutual recursion chain with alloc_search_andlist() and alloc_search_notkey(), with no depth limit. Courier IMAP has no overall command line length limit, making exploitation trivial. A single IMAP command with ~2500 nested parentheses overflows the 8MB default stack, causing SIGSEGV.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-674

Affected software

No affected versions have been published.

Timeline

Published: Jul 29, 2026
Last modified: Jul 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-671958.8Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system CVE-2026-671965.4Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML CVE-2026-671987.5Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows unauthenticated remote att CVE-2026-671996.5Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by sub CVE-2026-67207.2When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configura CVE-2026-672007.5Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the serv CVE-2026-672018.6V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circum CVE-2026-672045.4BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delet CVE-2026-672068.8Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to crea CVE-2026-672078.8Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated non-administrat CVE-2026-672089.8Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS com CVE-2026-67219.8IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can supply specially crafted input that is incorporated into OS co