CVE-2026-61908
published 2026-09-09CVE-2026-61908: An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to…
PriorityP337medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.22%
12.9th percentile
An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H-, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cyrus | imap | < 3.8.8 | 3.8.8 |
| cyrus | imap | >= 3.11.0 < 3.12.4 | 3.12.4 |
| cyrus | imap | >= 3.9.0 < 3.10.4 | 3.10.4 |
| cyrusimap | cyrus_imap | < 3.8.8 | 3.8.8 |
| cyrusimap | cyrus_imap | >= 3.11.0 < 3.12.4 | 3.12.4 |
| cyrusimap | cyrus_imap | >= 3.9.0 < 3.10.4 | 3.10.4 |
| debian | cyrus-imapd | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
vendor_redhat3.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
An issue was discovered in Cyrus IMAP before 3.12.4.
ghsa_unreviewed·2026-09-09
CVE-2026-61908 [LOW] CWE-125 An issue was discovered in Cyrus IMAP before 3.12.4.
An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H-, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.
VulDB
Cyrus IMAP up to 3.8.7/3.10.3/3.12.3 JMAP Blob ID out-of-bounds
vuldb·2026-09-09·CVSS 3.1
CVE-2026-61908 [LOW] Cyrus IMAP up to 3.8.7/3.10.3/3.12.3 JMAP Blob ID out-of-bounds
A vulnerability was found in Cyrus IMAP up to 3.8.7/3.10.3/3.12.3 and classified as critical. This affects an unknown function of the component JMAP Blob ID Handler. Executing a manipulation can lead to out-of-bounds read.
This vulnerability is registered as CVE-2026-61908. It is possible to launch the attack remotely. No exploit is available.
It is suggested to upgrade the affected component.
Red Hat
cyrus-imapd: cyrus-imapd: JMAP email-header blob ID out-of-bounds index
vendor_redhat·2026-09-10·CVSS 3.1
CVE-2026-61908 [LOW] CWE-125 cyrus-imapd: cyrus-imapd: JMAP email-header blob ID out-of-bounds index
cyrus-imapd: cyrus-imapd: JMAP email-header blob ID out-of-bounds index
An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H-, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.
A flaw was found in cyrus-imapd. An authenticated user could exploit this vulnerability by attempting to download a specially crafted JMAP (JSON Meta Application Protocol) blob ID. This action could lead to reading beyond the intended memory boundary, potentially exposing sensitive information from adjacent heap memory.
Mitigation: To reduce the attack surface, restrict network access to the `cyrus-imap
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-61908 cyrus-imapd: cyrus-imapd: JMAP email-header blob ID out-of-bounds index [fedora-all]
bugzilla·2026-09-10·CVSS 3.1
CVE-2026-61908 [LOW] CVE-2026-61908 cyrus-imapd: cyrus-imapd: JMAP email-header blob ID out-of-bounds index [fedora-all]
CVE-2026-61908 cyrus-imapd: cyrus-imapd: JMAP email-header blob ID out-of-bounds index [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An authenticated user could attempt to download a specially crafted JMAP blob ID of the form H-, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.
Bugzilla
CVE-2026-61908 cyrus-imapd: cyrus-imapd: JMAP email-header blob ID out-of-bounds index
bugzilla·2026-08-31·CVSS 3.1
CVE-2026-61908 [LOW] CVE-2026-61908 cyrus-imapd: cyrus-imapd: JMAP email-header blob ID out-of-bounds index
CVE-2026-61908 cyrus-imapd: cyrus-imapd: JMAP email-header blob ID out-of-bounds index
An authenticated user could attempt to download a specially crafted JMAP blob ID of the form H-, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.
2026-09-09
Published