DEBIAN-CVE-2026-61915

    Dashboard / Vulnerabilities / DEBIAN-CVE-2026-61915

    DEBIAN-CVE-2026-61915

    Published: 9 Sept 2026Last Modified: 11 Sept 2026
    Upstream:
    CVE-2026-61915

    Summary:

    Details: An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties.

    References: https://security-tracker.debian.org/tracker/CVE-2026-61915

    Affected packages

    Package

    Name: cyrus-imapd

    Purl: pkg:deb/debian/cyrus-imapd?arch=source&distro=bookworm

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    3.10.0-1
    3.10.0~beta1-1
    3.10.0~beta1-2
    3.10.0~beta1-3
    3.10.0~beta2-1
    3.10.0~rc2-1
    3.10.1-1
    3.10.1-2
    3.10.1-3
    3.10.1-3~bpo12+1
    3.10.2-1
    3.10.2-1~bpo12+1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    DEBIAN-CVE-2026-61915 | CVE-DB