Vulnerability · Published Jul 29, 2026 · Assigned by VulnCheck

CVE-2026-67194Courier IMAP < 6.0.1 Mail Server < 2.0.2 Stack Overflow DoS via Nested SEARCH Queries

Medium 6.5

In plain English

A medium-severity security flaw in Courier IMAP from svarshavchik. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 53.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser (alloc_search_key in searchinfo.C) recursively descends on nested parenthesized groups through a mutual recursion chain with alloc_search_andlist() and alloc_search_notkey(), with no depth limit. Courier IMAP has no overall command line length limit, making exploitation trivial. A single IMAP command with ~2500 nested parentheses overflows the 8MB default stack, causing SIGSEGV.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	courier	no fix listed	DEBIAN-CVE-2026-67194
Debian:13	courier	no fix listed	DEBIAN-CVE-2026-67194
Debian:14	courier	2.0.3-1	DEBIAN-CVE-2026-67194
Ubuntu:22.04:LTS	courier	no fix listed	UBUNTU-CVE-2026-67194
Ubuntu:26.04:LTS	courier	no fix listed	UBUNTU-CVE-2026-67194
Ubuntu:26.10	courier	no fix listed	UBUNTU-CVE-2026-67194

Affected products (as reported)

Vendor	Product	Versions
svarshavchik	Courier IMAP	0 – before 6.0.1
svarshavchik	Courier Mail Server	0 – before 2.0.2

Weakness: CWE-674 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Courier IMAP Release Notes release-notes
Courier Mail Server Release Notes release-notes
Patch Commit patch
Debian Package product
https://www.vulncheck.com/advisories/courier-imap-mail-server-stack-overflow-dos-via-nested-search-queries third-party-advisory