CVE-2026-67194
Courier IMAP < 6.0.1 Mail Server < 2.0.2 Stack Overflow DoS via Nested SEARCH Queries
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser (alloc_search_key in searchinfo.C) recursively descends on nested parenthesized groups through a mutual recursion chain with alloc_search_andlist() and alloc_search_notkey(), with no depth limit. Courier IMAP has no overall command line length limit, making exploitation trivial. A single IMAP command with ~2500 nested parentheses overflows the 8MB default stack, causing SIGSEGV.
| CWE | CWE-674 |
| Vendor | svarshavchik |
| Product | courier imap |
| Published | Jul 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for svarshavchik courier imap
Be the first to know when new medium vulnerabilities affecting svarshavchik courier imap are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
svarshavchik / Courier IMAP
0 < 6.0.1
svarshavchik / Courier Mail Server
0 < 2.0.2
References
github.com: https://github.com/svarshavchik/courier/releases/tag/courier-imap%2F6.0.1%2F20260627214444 github.com: https://github.com/svarshavchik/courier/releases/tag/courier%2F2.0.2%2F20260627214309 github.com: https://github.com/svarshavchik/courier-libs/commit/b5b5581aabea3efadf5e2944947ff0214aa3533e packages.debian.org: https://packages.debian.org/sid/courier-imap vulncheck.com: https://www.vulncheck.com/advisories/courier-imap-mail-server-stack-overflow-dos-via-nested-search-queries
Credits
Tristan Madani