CVE-2026-61915 cyrusimap CVE debrief

Who should care

CalDAV service administrators and security teams responsible for Cyrus IMAP deployments should assess exposure and apply patches or mitigations as needed. This includes reviewing current Cyrus IMAP versions, restricting access to CalDAV services, and monitoring logs for suspicious activity. Security teams should prioritize patching based on the medium severity of the vulnerability and potential service disruption.

Why it matters

CVE-2026-61915 is a medium-severity vulnerability in Cyrus IMAP that can be exploited by authenticated users to crash CalDAV workers. Administrators should review and apply patches, restrict access to CalDAV services, and monitor logs for suspicious activity.

• Potential service disruption due to CalDAV worker crashes
• Need for verification of Cyrus IMAP version and patch level
• Possible data integrity issues if not properly patched

Technical summary

The vulnerability is caused by a double-free issue in the VPATCH BYPARAM functionality of Cyrus IMAP. An authenticated calendar user can trigger the issue by sending a PATCH request with a specific format to a resource with two or more properties of the matched kind. This results in a crash of the Cyrus CalDAV worker. The vulnerability affects Cyrus IMAP before version 3.12.4 and can be exploited by authenticated users with access to CalDAV services. No additional technical details are available on the root cause or potential code fixes.

Defensive priority

Medium priority for CalDAV service administrators and security teams

Recommended defensive actions

• Review and apply patches for Cyrus IMAP versions prior to 3.12.4
• Restrict access to CalDAV services to trusted users
• Monitor CalDAV worker logs for suspicious activity
• Verify Cyrus IMAP version and patch level
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability was reported in the NVD vulnerability database and is described as a double-free issue in the VPATCH BYPARAM functionality of Cyrus IMAP. The issue can be triggered by an authenticated calendar user sending a PATCH request with a specific format. The memory holding the selector would be freed once on each iteration over the properties. No additional information is available on exploitability or potential impact beyond service disruption.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.