Junglewise Threat Intelligence

CVE-2026-67194: Courier IMAP and Mail Server stack overflow in SEARCH command parser

CVE-2026-67194 · Severity: medium · CVSS 6.5 · Published 2026-07-29

Executive brief

Courier IMAP and Courier Mail Server are widely used email server components that allow users to access their mailboxes. A vulnerability in these servers allows a logged-in user to crash the email service by sending a specially crafted search request. This can lead to a denial-of-service, preventing all users from accessing their email until the service is restarted.

Technical details

A stack-based buffer overflow exists in the SEARCH command parser of Courier IMAP (before 6.0.1) and Courier Mail Server (before 2.0.2). The vulnerability is caused by uncontrolled recursion in the 'alloc_search_key' function within 'searchinfo.C', which lacks a depth limit for nested parenthesized groups. An authenticated attacker can trigger a mutual recursion chain (involving alloc_search_andlist and alloc_search_notkey) by sending a single IMAP command with approximately 2,500 nested parentheses. This exhausts the default 8MB stack, resulting in a SIGSEGV and process crash. The issue is mitigated in Courier IMAP 6.0.1 and Courier Mail Server 2.0.2 by implementing hard caps on IMAP command constructs.

Affected products

  • svarshavchik Courier IMAP < 6.0.1
  • svarshavchik Courier Mail Server < 2.0.2

Timeline

  • 2026-06-27: patched: Fixes released in Courier IMAP 6.0.1 and Courier Mail Server 2.0.2
  • 2026-07-29: disclosed: Vulnerability details and CVE assigned

References