CVE-2026-67194

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-67194
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67194.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-67194
Downstream
Published
2026-07-29T16:39:09.617Z
Modified
2026-07-31T08:04:55.099556Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Courier IMAP < 6.0.1 Mail Server < 2.0.2 Stack Overflow DoS via Nested SEARCH Queries
Details

Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser (allocsearchkey in searchinfo.C) recursively descends on nested parenthesized groups through a mutual recursion chain with allocsearchandlist() and allocsearchnotkey(), with no depth limit. Courier IMAP has no overall command line length limit, making exploitation trivial. A single IMAP command with ~2500 nested parentheses overflows the 8MB default stack, causing SIGSEGV.

Database specific 
{
    "cwe_ids": [
        "CWE-674"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67194.json",
    "cna_assigner": "VulnCheck",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "6.0.1"
                },
                {
                    "fixed": "2.0.2"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "fixed": "6.0.1"
                },
                {
                    "fixed": "2.0.2"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/svarshavchik/courier-libs

Affected ranges

Type
GIT
Repo
https://github.com/svarshavchik/courier-libs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b5b5581aabea3efadf5e2944947ff0214aa3533e
Database specific 
{
    "source": "REFERENCES"
}

Affected versions

courier-authlib/0.*
courier-authlib/0.66.0/20130928223315
courier-authlib/0.66.1/20131111193749
courier-authlib/0.66.2/20150427083605
courier-authlib/0.66.3/20150628230025
courier-authlib/0.66.4/20151115120442
courier-authlib/0.67.0/20170128131141
courier-authlib/0.69.0/20180917223454
courier-authlib/0.69.1/20190724201053
courier-authlib/0.70.0/20200419164631
courier-authlib/0.71.0/20200618210228
courier-authlib/0.71.1/20210209205029
courier-authlib/0.71.2/20210319214948
courier-authlib/0.71.3/20210412205815
courier-authlib/0.71.4/20220307203309
courier-authlib/0.71.5/20220531232155
courier-authlib/0.71.6/20221114073152
courier-authlib/0.72.0/20221202210528
courier-authlib/0.72.1/20240130073737
courier-authlib/0.72.3/20240806075108
courier-authlib/0.72.4/20250406143640
courier-authlib/0.72.5/20251016211408
courier-authlib/0.72.6/20251109154458
courier-authlib/0.72.7/20260111153201
courier-authlib/0.73.0/20260620163941
courier-imap/4.*
courier-imap/4.14/20130928195544
courier-imap/4.15.1/20140901094658
courier-imap/4.15/20131128184113
courier-imap/4.16.0/20141213101457
courier-imap/4.16.1/20150427082912
courier-imap/4.16.2.20160306/20160307215443
courier-imap/4.16.2/20150628230425
courier-imap/4.17.0/20160426065621
courier-imap/4.17.1/20160508091211
courier-imap/4.17.2/20160814095842
courier-imap/4.17.2/20160814101108
courier-imap/4.17.3/20170117204906
courier-imap/4.18.1/20170819100155
courier-imap/4.18.2/20171004193929
courier-imap/5.*
courier-imap/5.0.0/20180917223909
courier-imap/5.0.1/20181013160554
courier-imap/5.0.10/20200420082513
courier-imap/5.0.11/20200618210620
courier-imap/5.0.12/20210209210152
courier-imap/5.0.2/20181027111303
courier-imap/5.0.3/20181117093458
courier-imap/5.0.4/20181128192207
courier-imap/5.0.5/20181217190442
courier-imap/5.0.6/20190130192542
courier-imap/5.0.7/20190330184405
courier-imap/5.0.8/20190831135704
courier-imap/5.0.9/20200419173038
courier-imap/5.1.0/20210319215058
courier-imap/5.1.1/20210320170246
courier-imap/5.1.2/20210326200013
courier-imap/5.1.3/20210424125018
courier-imap/5.1.4/20210801130116
courier-imap/5.1.5/20220116120150
courier-imap/5.1.6/20220116155411
courier-imap/5.1.7/20220116200038
courier-imap/5.1.8/20220531232414
courier-imap/5.1.9/20221114071655
courier-imap/5.2.0/20221202210713
courier-imap/5.2.1/20221217200828
courier-imap/5.2.10/20240831112031
courier-imap/5.2.11/20250406143715
courier-imap/5.2.2/20230219094143
courier-imap/5.2.3/20230404202923
courier-imap/5.2.4/20230429213643
courier-imap/5.2.5/20230828221040
courier-imap/5.2.6/20231125103405
courier-imap/5.2.7/20240714110618
courier-imap/5.2.9/20240806074556
courier-imap/5.3.0/20251016211621
courier-imap/5.3.1/20251023215123
courier-imap/5.3.2/20260111153337
courier-imap/6.*
courier-imap/6.0.0/20260620164348
courier-sox/0.*
courier-sox/0.12/20131006094016
courier-sox/0.13/20200616202004
courier-sox/0.14/20200618215757
courier-sox/0.15/20210209215744
courier-sox/0.16/20220531232226
courier-sox/0.17/20221114073802
courier-sox/0.18/20221202210750
courier-sox/0.19/20240806074431
courier-sox/0.20/20260111153438
courier-sox/0.21/20260620164046
courier-unicode/1.*
courier-unicode/1.0/20140112161619
courier-unicode/1.1/20140622092444
courier-unicode/1.2/20150427080623
courier-unicode/1.2/20150427080712
courier-unicode/1.3/20150628225959
courier-unicode/1.4/20150906072833
courier-unicode/2.*
courier-unicode/2.1/20180918065012
courier-unicode/2.2.2/20210319214424
courier-unicode/2.2.4/20220531234553
courier-unicode/2.2.5/20221114071538
courier-unicode/2.2.6/20221202203250
courier-unicode/2.3.0/20240104213613
courier-unicode/2.3.1/20240806073712
courier-unicode/2.3.1/20240806074124
courier-unicode/2.3.1/20240806074415
courier-unicode/2.3.2/20250406191735
courier-unicode/2.4.0/20251016211340
courier-unicode/2.5.0/20260111200543
courier-unicode/2.6.0/20260620163249
courier/0.*
courier/0.72/20130928195848
courier/0.73.1/20131223194809
courier/0.73.2/20140901093012
courier/0.73/20131128185623
courier/0.74.0/20141213101233
courier/0.74.1/20141214080824
courier/0.74.2/20150427082224
courier/0.74.2/20150427082630
courier/0.75.0/20150628230151
courier/0.76.0/20160426065735
courier/0.76.1/20160508090929
courier/0.76.2/20160814095637
courier/0.76.2/20160814100959
courier/0.76.3/20160917211918
courier/0.76.4/20170117203707
courier/0.78.0/20170819100405
courier/0.78.1/20171004193712
courier/0.78.2/20171203115636
courier/1.*
courier/1.0.1/20181013160807
courier/1.0.10/20200419171855
courier/1.0.11/20200420073456
courier/1.0.12/20200420082639
courier/1.0.13/20200424072124
courier/1.0.14/20200618210330
courier/1.0.15/20210209205145
courier/1.0.2/20181027103012
courier/1.0.3/20181117093143
courier/1.0.4/20181128192349
courier/1.0.5/20181217190604
courier/1.0.6/20190130192956
courier/1.0.7/20190330184047
courier/1.0.7/20190608085611
courier/1.0.8/20190608090758
courier/1.0.9/20190831140324
courier/1.0/20180917223614
courier/1.1.0/20210319215318
courier/1.1.1/20210320170424
courier/1.1.10/20220606180754
courier/1.1.11/20221114072017
courier/1.1.2/20210326200147
courier/1.1.3/20210424125125
courier/1.1.4/20210518212001
courier/1.1.5/20210801125842
courier/1.1.6/20220116120022
courier/1.1.7/20220116155014
courier/1.1.8/20220116195856
courier/1.1.9/20220531232250
courier/1.2.0/20221202210553
courier/1.2.1/20221217200325
courier/1.2.2/20230219094715
courier/1.2.3/20230404081412
courier/1.2.4/20230429213520
courier/1.3.0/20230531081926
courier/1.3.1/20230601191859
courier/1.3.10/20240720165805
courier/1.3.11/20240806074441
courier/1.3.12/20240831111910
courier/1.3.13/20240921094446
courier/1.3.2/20230602081837
courier/1.3.3/20230814090547
courier/1.3.4/20230828203057
courier/1.3.5/20231125103240
courier/1.3.7/20240423073735
courier/1.3.7/20240423220621
courier/1.3.8/20240511163232
courier/1.3.9/20240714110903
courier/1.4.0/20250316103417
courier/1.4.1/20250406143953
courier/1.5.0/20251016211441
courier/1.5.1/20251023214928
courier/1.6.0/20260111153226
courier/2.*
courier/2.0.0/20260620164119
courier/2.0.1/20260621222951
maildrop/2.*
maildrop/2.7.0/20130928195403
maildrop/2.7.1/20131128184356
maildrop/2.7.2/20140901092804
maildrop/2.8.0/20141213101719
maildrop/2.8.1/20141214081550
maildrop/2.8.2/20150427083304
maildrop/2.8.3/20150628231513
maildrop/2.8.4/20160814100858
maildrop/2.8.5/20170117205233
maildrop/2.9.0/20170702105314
maildrop/2.9.1/20170819100311
maildrop/2.9.1/20171004194531
maildrop/2.9.1/20171005071202
maildrop/2.9.2/20171005081210
maildrop/2.9.3/20171203115314
maildrop/3.*
maildrop/3.0.0/20180917224237
maildrop/3.0.1/20200618220426
maildrop/3.0.2/20210209215800
maildrop/3.0.3/20210319214705
maildrop/3.0.4/20220116120401
maildrop/3.0.5/20220116155756
maildrop/3.0.6/20220116200345
maildrop/3.0.8/20220531232954
maildrop/3.0.9/20221114071842
maildrop/3.1.0/20221202210755
maildrop/3.1.1/20230219094055
maildrop/3.1.2/20230404203122
maildrop/3.1.3/20230406063650
maildrop/3.1.4/20230406203412
maildrop/3.1.5/20230429221502
maildrop/3.1.6/20230814090338
maildrop/3.1.7/20240713092132
maildrop/3.1.8/20240806074759
maildrop/3.2.0/20251016211823
maildrop/3.2.1/20251023215516
maildrop/3.3.0/20260111153444
maildrop/4.*
maildrop/4.0.0/20260620164616
maildrop/4.0.1/20260621223141
sqwebmail/5.*
sqwebmail/5.7.0/20130928195718
sqwebmail/5.7.1/20131128184237
sqwebmail/5.7.2/20131223195015
sqwebmail/5.7.3/20140901092902
sqwebmail/5.8.0/20141213101603
sqwebmail/5.8.1/20141214081101
sqwebmail/5.8.2/20150427083025
sqwebmail/5.8.3/20150628231305
sqwebmail/5.8.4/20170117205036
sqwebmail/5.9.1/20171004194032
sqwebmail/5.9.2/20171203115438
sqwebmail/6.*
sqwebmail/6.0.0/20180917224034
sqwebmail/6.0.1/20190330184554
sqwebmail/6.0.1/20190608084158
sqwebmail/6.0.10/20220531233348
sqwebmail/6.0.11/20221114071756
sqwebmail/6.0.2/20190608084438
sqwebmail/6.0.3/20190831135524
sqwebmail/6.0.5/20210209210407
sqwebmail/6.0.6/20210319214818
sqwebmail/6.0.7/20220116120232
sqwebmail/6.0.8/20220116155536
sqwebmail/6.0.9/20220116200148
sqwebmail/6.1.0/20221202210816
sqwebmail/6.1.1/20230404203032
sqwebmail/6.1.2/20230429213739
sqwebmail/6.2.0/20230531081841
sqwebmail/6.2.1/20230601191748
sqwebmail/6.2.2/20230602082020
sqwebmail/6.2.3/20230814090001
sqwebmail/6.2.4/20230828203010
sqwebmail/6.2.5/20231125103447
sqwebmail/6.2.6/20240423230632
sqwebmail/6.2.7/20240511163149
sqwebmail/6.2.8/20240720165950
sqwebmail/6.2.9/20240806074638
sqwebmail/6.3.0/20251016211734
sqwebmail/6.3.1/20251023215331
sqwebmail/6.3.1/20260111153507
sqwebmail/7.*
sqwebmail/7.0.0/20260620164452
sqwebmail/7.0.1/20260621223103

Database specific

vanir_signatures_modified 
"2026-07-31T08:04:55Z"
vanir_signatures 
[
    {
        "signature_type": "Line",
        "target": {
            "file": "imap/searchinfo.h"
        },
        "deprecated": false,
        "source": "https://github.com/svarshavchik/courier-libs/commit/b5b5581aabea3efadf5e2944947ff0214aa3533e",
        "id": "CVE-2026-67194-50345343",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "324102191788101242559591669349694290702",
                "35235881022085087855072741834168207339",
                "22998871602831633174075279873829851744"
            ],
            "threshold": 0.9
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67194.json"