CVE-2026-67194 Details

A denial-of-service vulnerability has been identified in Courier IMAP versions prior to 6.0.1 and Courier Mail Server versions prior to 2.0.2. This vulnerability allows authenticated IMAP users to crash the imapd process by sending deeply nested parenthesized SEARCH queries. The issue arises because the SEARCH command parser recursively processes nested groups without a depth limit, leading to uncontrolled recursion. Additionally, Courier IMAP does not impose a command line length limit, which facilitates exploitation. A single IMAP command with approximately 2500 nested parentheses can overflow the default 8MB stack limit, causing a segmentation fault (SIGSEGV).

Users can upgrade to Courier IMAP version 6.0.1 or later, and Courier Mail Server version 2.0.2 or later, to address this vulnerability.