CVE-2026-61908: Low severity Cyrus IMAP vulnerability
An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H<emailid>-<index>, which could read past the end of the internal blobheaders array during download, exposing adjacent heap memory.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Cyrus IMAP deployments running a version before 3.12.4 are affected where JMAP email-header blob downloads are available to authenticated users.
What access does an attacker need?
An attacker needs valid authenticated access and must submit a crafted JMAP blob ID in the form H<emailid>-<index>. Exploitation has high attack complexity and does not require user interaction.
What could be disclosed if exploitation succeeds?
The out-of-bounds read may expose adjacent heap memory during the crafted blob download. The reported impact is limited to confidentiality; no integrity or availability impact is identified.
How can I determine whether a system is affected?
Check the installed Cyrus IMAP version. Versions before 3.12.4 are affected; updating to 3.12.4 or later addresses the issue.