Is CVE-2026-61915 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61915 being exploited in the wild.

How severe is CVE-2026-61915?

Medium severity, with a CVSS score of 4.2, published 9 September 2026.

Is there a fix for CVE-2026-61915?

A patch was published on 2026-09-09: Fixed in Cyrus IMAP 3.12.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61915 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-61915?

Check whether you run Cyrus IMAP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61915: Cyrus IMAP double-free in CalDAV VPATCH handler

CVE-2026-61915 · Severity: medium · CVSS 4.2 · Published 2026-09-09

Cyrus IMAP is an email, calendar, and contact server widely used in enterprise and university environments. An authenticated calendar user can crash the CalDAV service by sending a specially crafted PATCH request, causing a denial of service that may interrupt calendar access for multiple users.

Vendors: Cyrus.

Quick answers

Is CVE-2026-61915 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61915 being exploited in the wild.
How severe is CVE-2026-61915?: Medium severity, with a CVSS score of 4.2, published 9 September 2026.
Which products and versions are affected?: Cyrus IMAP before 3.12.4.
Is there a fix for CVE-2026-61915?: A patch was published on 2026-09-09: Fixed in Cyrus IMAP 3.12.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61915 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-61915?: Check whether you run Cyrus IMAP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A double-free vulnerability exists in the CalDAV VPATCH request handler when processing PATCH-ACTION="BYPARAM@..." directives against resources with two or more matching properties. The memory selector is freed multiple times—once per iteration over matching properties—leading to a heap corruption and crash of the CalDAV worker process. The vulnerability requires an authenticated calendar user on the system and network access to the CalDAV service. An attacker can trigger the crash repeatedly to achieve denial of service. The issue is fixed in Cyrus IMAP 3.12.4 and later.

Affected products

Cyrus Cyrus IMAP before 3.12.4

Timeline

2026-09-09: disclosed
2026-09-09: patched: Fixed in Cyrus IMAP 3.12.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.