CVE-2026-61915CWE-415

CVE-2026-61915

Medium · published September 10, 2026

CVSS v3.1
4.2
EPSS
0%
Percentile
16.6
In the wild
Unconfirmed
What it is

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00259 · 16.6th percentile
Weakness
CWE-415 · Double Free
Published
2026-09-10T00:18Z
Affected products (3)
ProductVersionsFixed in
cyrus/imap< 3.8.83.8.8
cyrus/imap≥ 3.9.0, < 3.10.43.10.4
cyrus/imap≥ 3.11.0, < 3.12.43.12.4
References (4)
https://cyrusimap.org · [email protected]https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html · [email protected]https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html · [email protected]https://www.cyrusimap.org/3.12/imap/download/release-notes/3.8/x/3.8.8.html · [email protected]
EPSS history
Timeline
  • 11 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 09 SEP 00:00Z
    An issue was discovered in Cyrus IMAP before 3.12.4
    cvelistv5