UBUNTU-CVE-2026-67194

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-67194

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-67194.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-67194

Upstream

CVE-2026-67194

Published

2026-07-29T17:16:00Z

Modified

2026-08-06T03:11:24Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser (alloc_search_key in searchinfo.C) recursively descends on nested parenthesized groups through a mutual recursion chain with alloc_search_andlist() and alloc_search_notkey(), with no depth limit. Courier IMAP has no overall command line length limit, making exploitation trivial. A single IMAP command with ~2500 nested parentheses overflows the 8MB default stack, causing SIGSEGV.

References

Affected packages

Ubuntu:16.04:LTS / courier

Package

Name: courier
Purl: pkg:deb/ubuntu/courier?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.68.2-1ubuntu5

0.68.2-1ubuntu6

0.68.2-1ubuntu7

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "courier-base",
            "binary_version": "0.68.2-1ubuntu7"
        },
        {
            "binary_name": "courier-faxmail",
            "binary_version": "0.68.2-1ubuntu7"
        },
        {
            "binary_name": "courier-imap",
            "binary_version": "4.10.0-20120615-1ubuntu7"
        },
        {
            "binary_name": "courier-imap-ssl",
            "binary_version": "4.10.0-20120615-1ubuntu7"
        },
        {
            "binary_name": "courier-ldap",
            "binary_version": "0.68.2-1ubuntu7"
        },
        {
            "binary_name": "courier-maildrop",
            "binary_version": "0.68.2-1ubuntu7"
        },
        {
            "binary_name": "courier-mlm",
            "binary_version": "0.68.2-1ubuntu7"
        },
        {
            "binary_name": "courier-mta",
            "binary_version": "0.68.2-1ubuntu7"
        },
        {
            "binary_name": "courier-mta-ssl",
            "binary_version": "0.68.2-1ubuntu7"
        },
        {
            "binary_name": "courier-pcp",
            "binary_version": "0.68.2-1ubuntu7"
        },
        {
            "binary_name": "courier-pop",
            "binary_version": "0.68.2-1ubuntu7"
        },
        {
            "binary_name": "courier-pop-ssl",
            "binary_version": "0.68.2-1ubuntu7"
        },
        {
            "binary_name": "courier-ssl",
            "binary_version": "0.68.2-1ubuntu7"
        },
        {
            "binary_name": "courier-webadmin",
            "binary_version": "0.68.2-1ubuntu7"
        },
        {
            "binary_name": "sqwebmail",
            "binary_version": "0.68.2-1ubuntu7"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-67194.json"

Ubuntu:18.04:LTS / courier

Package

Name: courier
Purl: pkg:deb/ubuntu/courier?arch=source&distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.78.0-2

0.78.0-2ubuntu1

0.78.0-2ubuntu2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "courier-base",
            "binary_version": "0.78.0-2ubuntu2"
        },
        {
            "binary_name": "courier-faxmail",
            "binary_version": "0.78.0-2ubuntu2"
        },
        {
            "binary_name": "courier-imap",
            "binary_version": "4.18.1+0.78.0-2ubuntu2"
        },
        {
            "binary_name": "courier-imap-ssl",
            "binary_version": "4.18.1+0.78.0-2ubuntu2"
        },
        {
            "binary_name": "courier-ldap",
            "binary_version": "0.78.0-2ubuntu2"
        },
        {
            "binary_name": "courier-maildrop",
            "binary_version": "2.9.1+0.78.0-2ubuntu2"
        },
        {
            "binary_name": "courier-mlm",
            "binary_version": "0.78.0-2ubuntu2"
        },
        {
            "binary_name": "courier-mta",
            "binary_version": "0.78.0-2ubuntu2"
        },
        {
            "binary_name": "courier-mta-ssl",
            "binary_version": "0.78.0-2ubuntu2"
        },
        {
            "binary_name": "courier-pcp",
            "binary_version": "0.78.0-2ubuntu2"
        },
        {
            "binary_name": "courier-pop",
            "binary_version": "0.78.0-2ubuntu2"
        },
        {
            "binary_name": "courier-pop-ssl",
            "binary_version": "0.78.0-2ubuntu2"
        },
        {
            "binary_name": "courier-ssl",
            "binary_version": "0.78.0-2ubuntu2"
        },
        {
            "binary_name": "courier-webadmin",
            "binary_version": "0.78.0-2ubuntu2"
        },
        {
            "binary_name": "sqwebmail",
            "binary_version": "5.9.0+0.78.0-2ubuntu2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-67194.json"

Ubuntu:20.04:LTS / courier

Package

Name: courier
Purl: pkg:deb/ubuntu/courier?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.6-1build1

1.0.6-1build2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "courier-base",
            "binary_version": "1.0.6-1build2"
        },
        {
            "binary_name": "courier-faxmail",
            "binary_version": "1.0.6-1build2"
        },
        {
            "binary_name": "courier-imap",
            "binary_version": "5.0.6+1.0.6-1build2"
        },
        {
            "binary_name": "courier-ldap",
            "binary_version": "1.0.6-1build2"
        },
        {
            "binary_name": "courier-mlm",
            "binary_version": "1.0.6-1build2"
        },
        {
            "binary_name": "courier-mta",
            "binary_version": "1.0.6-1build2"
        },
        {
            "binary_name": "courier-pcp",
            "binary_version": "1.0.6-1build2"
        },
        {
            "binary_name": "courier-pop",
            "binary_version": "1.0.6-1build2"
        },
        {
            "binary_name": "courier-webadmin",
            "binary_version": "1.0.6-1build2"
        },
        {
            "binary_name": "sqwebmail",
            "binary_version": "6.0.0+1.0.6-1build2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-67194.json"

Ubuntu:22.04:LTS / courier

Package

Name: courier
Purl: pkg:deb/ubuntu/courier?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.16-3build1

1.0.16-3build2

1.0.16-3build3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "courier-base",
            "binary_version": "1.0.16-3build3"
        },
        {
            "binary_name": "courier-faxmail",
            "binary_version": "1.0.16-3build3"
        },
        {
            "binary_name": "courier-imap",
            "binary_version": "5.0.13+1.0.16-3build3"
        },
        {
            "binary_name": "courier-ldap",
            "binary_version": "1.0.16-3build3"
        },
        {
            "binary_name": "courier-mlm",
            "binary_version": "1.0.16-3build3"
        },
        {
            "binary_name": "courier-mta",
            "binary_version": "1.0.16-3build3"
        },
        {
            "binary_name": "courier-pcp",
            "binary_version": "1.0.16-3build3"
        },
        {
            "binary_name": "courier-pop",
            "binary_version": "1.0.16-3build3"
        },
        {
            "binary_name": "courier-webadmin",
            "binary_version": "1.0.16-3build3"
        },
        {
            "binary_name": "sqwebmail",
            "binary_version": "6.0.5+1.0.16-3build3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-67194.json"

Ubuntu:26.04:LTS / courier

Package

Name: courier
Purl: pkg:deb/ubuntu/courier?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.4.1-3

1.4.1-10

1.5.1-2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "courier-base",
            "binary_version": "1.5.1-2"
        },
        {
            "binary_name": "courier-faxmail",
            "binary_version": "1.5.1-2"
        },
        {
            "binary_name": "courier-imap",
            "binary_version": "5.3.1+1.5.1-2"
        },
        {
            "binary_name": "courier-ldap",
            "binary_version": "1.5.1-2"
        },
        {
            "binary_name": "courier-mlm",
            "binary_version": "1.5.1-2"
        },
        {
            "binary_name": "courier-mta",
            "binary_version": "1.5.1-2"
        },
        {
            "binary_name": "courier-pcp",
            "binary_version": "1.5.1-2"
        },
        {
            "binary_name": "courier-pop",
            "binary_version": "1.5.1-2"
        },
        {
            "binary_name": "courier-webadmin",
            "binary_version": "1.5.1-2"
        },
        {
            "binary_name": "sqwebmail",
            "binary_version": "6.3.1+1.5.1-2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-67194.json"