CVE-2026-61915
published 2026-09-09CVE-2026-61915: An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker…
PriorityP336high7.1CVSS 3.1
AVNACLPRLUINSUCNILAH
EPSS
0.26%
17.4th percentile
An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cyrus | imap | < 3.8.8 | 3.8.8 |
| cyrus | imap | >= 3.11.0 < 3.12.4 | 3.12.4 |
| cyrus | imap | >= 3.9.0 < 3.10.4 | 3.10.4 |
| cyrusimap | cyrus_imap | < 3.8.8 | 3.8.8 |
| cyrusimap | cyrus_imap | >= 3.11.0 < 3.12.4 | 3.12.4 |
| cyrusimap | cyrus_imap | >= 3.9.0 < 3.10.4 | 3.10.4 |
| debian | cyrus-imapd | — | — |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
vendor_redhat4.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
cyrus-imapd: cyrus-imapd: VPATCH BYPARAM double-free in CalDAV
vendor_redhat·2026-09-10·CVSS 4.2
CVE-2026-61915 [MEDIUM] CWE-415 cyrus-imapd: cyrus-imapd: VPATCH BYPARAM double-free in CalDAV
cyrus-imapd: cyrus-imapd: VPATCH BYPARAM double-free in CalDAV
An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties.
A flaw was found in cyrus-imapd. An authenticated calendar user could trigger a double-free vulnerability in the Cyrus CalDAV worker. By sending a specially crafted PATCH request that includes PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind, the memory holding the selector would be freed multiple times. This could lead t
VulDB
Cyrus IMAP up to 3.8.7/3.10.3/3.12.3 CalDAV double free
vuldb·2026-09-09·CVSS 4.2
CVE-2026-61915 [MEDIUM] Cyrus IMAP up to 3.8.7/3.10.3/3.12.3 CalDAV double free
A vulnerability was found in Cyrus IMAP up to 3.8.7/3.10.3/3.12.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component CalDAV. The manipulation results in double free.
This vulnerability is cataloged as CVE-2026-61915. The attack may be launched remotely. There is no exploit available.
It is suggested to upgrade the affected component.
GHSA
An issue was discovered in Cyrus IMAP before 3.12.4.
ghsa_unreviewed·2026-09-09
CVE-2026-61915 [MEDIUM] CWE-415 An issue was discovered in Cyrus IMAP before 3.12.4.
An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-61915 cyrus-imapd: cyrus-imapd: VPATCH BYPARAM double-free in CalDAV [fedora-all]
bugzilla·2026-09-10·CVSS 4.2
CVE-2026-61915 [MEDIUM] CVE-2026-61915 cyrus-imapd: cyrus-imapd: VPATCH BYPARAM double-free in CalDAV [fedora-all]
CVE-2026-61915 cyrus-imapd: cyrus-imapd: VPATCH BYPARAM double-free in CalDAV [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties.
Bugzilla
CVE-2026-61915 cyrus-imapd: cyrus-imapd: VPATCH BYPARAM double-free in CalDAV
bugzilla·2026-08-31·CVSS 4.2
CVE-2026-61915 [MEDIUM] CVE-2026-61915 cyrus-imapd: cyrus-imapd: VPATCH BYPARAM double-free in CalDAV
CVE-2026-61915 cyrus-imapd: cyrus-imapd: VPATCH BYPARAM double-free in CalDAV
An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties.
Bugzilla
CVE-2025-61915 CUPS: Local denial-of-service via cupsd.conf update and related issues
bugzilla·2025-11-20·CVSS 6.7
CVE-2025-61915 [MEDIUM] CVE-2025-61915 CUPS: Local denial-of-service via cupsd.conf update and related issues
CVE-2025-61915 CUPS: Local denial-of-service via cupsd.conf update and related issues
A user in group defined by SystemGroup directive in /etc/cups/cups-files.conf can use the cups web ui to change the config
and insert a malicious line.
Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2026:0312 https://access.redhat.com/errata/RHSA-2026:0312
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2026:0464 https://access.redhat.com/errata/RHSA-2026:0464
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2026:0596 https://access.redhat.
2026-09-09
Published