GCVE - cpe:2.3:a:svarshavchik:courier_mail

Approved changes feed: RSS · Atom

cpe:2.3:a:svarshavchik:courier_mail_server:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Svarshavchik (`91a5deeb-d750-5698-bbef-1da64b5760d1`)
Product	Courier Mail Server (`f1f3daf4-6bba-5149-9093-7e91e76c3577`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-67194`	vulnerable	2026-09-16 04:33:05.652479	Courier IMAP < 6.0.1 Mail Server < 2.0.2 Stack Overflow DoS via Nested SEARCH Queries MEDIUM (6.5) Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser (alloc_search_key in searchinfo.C) recursively descends on nested parenthesized groups through a mutual recursion chain with alloc_search_andlist() and alloc_search_notkey(), with no depth limit. Courier IMAP has no overall command line length limit, making exploitation trivial. A single IMAP command with ~2500 nested parentheses overflows the 8MB default stack, causing SIGSEGV. Published: 2026-07-29T16:39:09.617Z Updated: 2026-11-08T14:08:07.565Z Open on db.gcve.eu Reference links https://github.com/svarshavchik/courier/releases/tag/courier-imap%2F6.0.1%2F20260627214444 https://github.com/svarshavchik/courier/releases/tag/courier%2F2.0.2%2F20260627214309 https://github.com/svarshavchik/courier-libs/commit/b5b5581aabea3efadf5e2944947ff0214aa3533e https://packages.debian.org/sid/courier-imap https://www.vulncheck.com/advisories/courier-imap-mail-server-stack-overflow-dos-via-nested-search-queries	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.