CVE-2026-67194

Deferred Deferred - Pending Action

Authenticated IMAP Command Injection in Courier Mail Server

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: VulnCheck

Description

Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser (alloc_search_key in searchinfo.C) recursively descends on nested parenthesized groups through a mutual recursion chain with alloc_search_andlist() and alloc_search_notkey(), with no depth limit. Courier IMAP has no overall command line length limit, making exploitation trivial. A single IMAP command with ~2500 nested parentheses overflows the 8MB default stack, causing SIGSEGV.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-67194

Affected Vendors & Products

Vendor	Product	Version / Range
courier	mta	to 6.0.1 (exc)
courier	mail_server	to 2.0.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This is a denial-of-service vulnerability in Courier IMAP and Mail Server. Authenticated users can crash the imapd process by sending deeply nested parenthesized SEARCH queries. The parser recursively processes these queries without a depth limit, causing a stack overflow when around 2500 nested parentheses are used. This leads to a SIGSEGV crash due to exceeding the default 8MB stack size.

Detection Guidance

To detect this vulnerability, monitor for crashes in the Courier IMAP service (imapd) when processing IMAP SEARCH commands. Check logs for segmentation faults or excessive resource usage during IMAP operations. No specific commands are provided in the context, but inspecting IMAP server logs for unusual nested SEARCH query patterns may indicate exploitation attempts.

Impact Analysis

If you use Courier IMAP or Mail Server, an attacker with valid IMAP credentials could exploit this to crash the mail server process. This would disrupt email services for all users, cause service outages, and require manual restart of the affected service.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions that violate uptime requirements in GDPR or HIPAA. Downtime may lead to data processing delays or unavailability of critical email services, potentially breaching availability requirements in these regulations.

Mitigation Strategies

Upgrade Courier IMAP to version 6.0.1 or later and Courier Mail Server to version 2.0.2 or later. These versions address the stack overflow issue by fixing the recursive SEARCH command parser. If immediate upgrading is not possible, restrict IMAP access to trusted users or disable complex SEARCH operations as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-67194. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70