CVE-2026-61915: Double Free
An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cyrus IMAPto a version that resolves this vulnerability.Fixed in 3.12.4Patch VPATCH BYPARAM double-free
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated calendar user can trigger the flaw. The vulnerable request targets a CalDAV resource that has two or more properties of the kind matched by the selector.
What request is required to trigger the crash?
The attacker must send a VPATCH request using PATCH-ACTION="BYPARAM@...". Exploitation requires iterating over at least two matching properties, causing the selector memory to be freed more than once.
What is the operational impact?
A successful attack can crash a Cyrus CalDAV worker. The provided information identifies integrity and availability impacts, but does not describe confidentiality impact or code execution.
Which versions are affected?
Cyrus IMAP versions before 3.12.4 are affected according to the description. The provided release-note references also include 3.10.4, but the description does not explicitly state the full affected version ranges or whether that release contains a fix.