Description
Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cyrus-imapd | 3.0.12-1 | — |
| Debian 13 | cyrus-imapd | 3.0.12-1 | — |
| Debian 12 | cyrus-imapd | 3.0.12-1 | — |
| Debian 9 | cyrus-imapd | 2.5.10-3+deb9u3 | DLA-3052-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | cyrus-imapd | 3.0.12-1 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | cyrus-imapd | 3.8.2-1ubuntu0.1~esm1 | USN-7224-1 |
| Ubuntu Pro 22.04 LTS | cyrus-imapd | 3.4.3-3ubuntu0.1+esm1 | USN-7224-1 |
| Ubuntu Pro 20.04 LTS | cyrus-imapd | 3.0.13-5ubuntu0.1~esm1 | USN-7224-1 |
| Ubuntu Pro 18.04 LTS | cyrus-imapd | 2.5.10-3ubuntu1.1+esm1 | USN-7224-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | cyrus-imapd +2 | 3.0.7-19.el8 | RHSA-2020:4655 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cyrus-imapd | 3.8.4-1.1 | openSUSE-SU-2025:14968-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | cyrus-imapd +2 | 3.0.7-19.el8 | ELSA-2020-4655 |
Advisories 6
- USN-7224-1 cyrus-imapd vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-3052-1 cyrus-imapd - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2025:14968-1 cyradm-3.8.4-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2020:4655 Red Hat Security Advisory: cyrus-imapd security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- WID-SEC-2022-0388 cyrus imapd: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jan 23, 2025
- ELSA-2020-4655 Moderate: cyrus-imapd security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 10, 2020
References
- https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.12.html
- https://www.cyrusimap.org/imap/download/release-notes/2.5/x/2.5.14.html
- FEDORA-2019-393e1cef4d vendor-advisory
- FEDORA-2019-03be160f9c vendor-advisory
- [debian-lts-announce] 20220619 [SECURITY] [DLA 3052-1] cyrus-imapd security update mailing-list