Medium 6.5Published Jul 29, 2026

CVE-2026-67194Courier IMAP < 6.0.1 Mail Server < 2.0.2 Stack Overflow DoS via Nested SEARCH Queries

Updated under an hour ago (Oct 27, 2026, 4:30 PM ET)

Does this affect you?

It affects svarshavchik Courier IMAP and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for svarshavchik Courier IMAP

Exploited in the last 30 days

Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser (alloc_search_key in searchinfo.C) recursively descends on nested parenthesized groups through a mutual recursion chain with alloc_search_andlist() and alloc_search_notkey(), with no depth limit. Courier IMAP has no overall command line length limit, making exploitation trivial. A single IMAP command with ~2500 nested parentheses overflows the 8MB default stack, causing SIGSEGV.

CVSS: 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-674
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Aug 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

svarshavchik Courier IMAP svarshavchik:courier_imap (from the name)	before 6.0.1	CNA record
svarshavchik Courier Mail Server svarshavchik:courier_mail_server (from the name)	before 2.0.2	CNA record

References

References

https://github.com/svarshavchik/courier/releases/tag/courier-imap%2F6.0.1%2F20260627214444	release-notes
https://github.com/svarshavchik/courier/releases/tag/courier%2F2.0.2%2F20260627214309	release-notes
https://github.com/svarshavchik/courier-libs/commit/b5b5581aabea3efadf5e2944947ff0214aa3533e	patch
https://packages.debian.org/sid/courier-imap	product
https://www.vulncheck.com/advisories/courier-imap-mail-server-stack-overflow-dos-via-nested-search-queries	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.