Dashboard / CVE-2026-67194

CVE-2026-67194

HIGH
MEDIUM Priority: 0.04 BB Relevance: 64/100
Published: 2026-07-29 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: None
VC: None
VI: None
VA: High

Description

Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser (alloc_search_key in searchinfo.C) recursively descends on nested parenthesized groups through a mutual recursion chain with alloc_search_andlist() and alloc_search_notkey(), with no depth limit. Courier IMAP has no overall command line length limit, making exploitation trivial. A single IMAP command with ~2500 nested parentheses overflows the 8MB default stack, causing SIGSEGV.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
svarshavchik Courier IMAP 0 < 6.0.1
svarshavchik Courier Mail Server 0 < 2.0.2

References & Advisories (5)

Bug Bounty Relevance

64 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

7.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.55%
Raw Score 0.005480
Percentile 46.5%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00548
2026-11-12
0.00548
2026-11-10
0.00548
2026-11-09
0.00548
2026-11-08
0.00548

Intelligence Sources

mitre ref →

External Links