CLSA-2026-1790173408

See a problem?
Import Source
https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1790173408.json
JSON Data
https://api.osv.dev/v1/vulns/CLSA-2026-1790173408
Upstream
CVE (3)
Published
2026-09-23T14:23:39Z
Modified
2026-10-26T09:43:36Z
Summary
cyrus-imapd: Fix of 3 CVEs
Details
  • fix CVE-2026-61915: double-free in the CalDAV VPATCH BYPARAM selector
  • fix CVE-2026-61909: calendar/addressbook-multiget returned resources the user has no ACL on
  • fix CVE-2026-61911: Sieve mailboxexists/metadata probed other users' mailboxes without a lookup-rights check
  • do not free VPATCH parameters already removed by reference: libical frees them in icalproperty_remove_parameter_by_ref(), so the following icalparameter_free() aborted the CalDAV worker on any VPATCH carrying a PATCH-ACTION parameter, before the CVE-2026-61915 code path could be reached
  • add the upstream cunit regression test for CVE-2026-61915
  • run the cunit suite in %check even when cassandane is disabled, so the regression test above actually executes
References

Affected packages

TuxCare:AlmaLinux:9.6
cyrus-imapd

Package

Name
cyrus-imapd
Purl
pkg:rpm/tuxcare/cyrus-imapd?distro=almalinux-9.6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.4.8-2.el9_6.tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1790173408.json"
cyrus-imapd-devel

Package

Name
cyrus-imapd-devel
Purl
pkg:rpm/tuxcare/cyrus-imapd-devel?distro=almalinux-9.6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.4.8-2.el9_6.tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1790173408.json"
cyrus-imapd-doc-extra

Package

Name
cyrus-imapd-doc-extra
Purl
pkg:rpm/tuxcare/cyrus-imapd-doc-extra?distro=almalinux-9.6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.4.8-2.el9_6.tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1790173408.json"
cyrus-imapd-libs

Package

Name
cyrus-imapd-libs
Purl
pkg:rpm/tuxcare/cyrus-imapd-libs?distro=almalinux-9.6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.4.8-2.el9_6.tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1790173408.json"
cyrus-imapd-utils

Package

Name
cyrus-imapd-utils
Purl
pkg:rpm/tuxcare/cyrus-imapd-utils?distro=almalinux-9.6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.4.8-2.el9_6.tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1790173408.json"
cyrus-imapd-virusscan

Package

Name
cyrus-imapd-virusscan
Purl
pkg:rpm/tuxcare/cyrus-imapd-virusscan?distro=almalinux-9.6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.4.8-2.el9_6.tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1790173408.json"
perl-Cyrus

Package

Name
perl-Cyrus
Purl
pkg:rpm/tuxcare/perl-Cyrus?distro=almalinux-9.6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.4.8-2.el9_6.tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1790173408.json"