Description
Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser (alloc_search_key in searchinfo.C) recursively descends on nested parenthesized groups through a mutual recursion chain with alloc_search_andlist() and alloc_search_notkey(), with no depth limit. Courier IMAP has no overall command line length limit, making exploitation trivial. A single IMAP command with ~2500 nested parentheses overflows the 8MB default stack, causing SIGSEGV.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| svarshavchik | Courier IMAP | < 6.0.1 | 6.0.1 |
| svarshavchik | Courier Mail Server | < 2.0.2 | 2.0.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | courier | 2.0.3-1 | — |
| Debian 13 | courier | No fix yet | — |
| Debian 12 | courier | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | courier | No fix yet | — |
| Ubuntu 26.04 LTS | courier | No fix yet | — |
| Ubuntu 22.04 LTS | courier | No fix yet | — |
| Ubuntu 20.04 LTS | courier | No fix yet | — |
| Ubuntu 18.04 LTS | courier | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | courier | No fix yet | — |
References
- Courier IMAP 6.0.1 Release Notes release-notes
- Courier Mail Server 2.0.2 Release Notes release-notes
- Patch Commit patch
- Debian Package product
- https://www.vulncheck.com/advisories/courier-imap-mail-server-stack-overflow-dos-via-nested-search-queries third-party-advisory