CVE-2024-34055

Name of the Vulnerable Software and Affected Versions Cyrus IMAP versions prior to 3.8.3 Cyrus IMAP versions 3.10.x prior to 3.10.0-rc1

Description The issue is related to a buffer overflow in memory, which can be exploited by sending several literals in a single command, potentially allowing a remote attacker to cause a denial of service. Authenticated attackers can cause unbounded memory allocation by sending many LITERALs in a single command.

Recommendations For Cyrus IMAP versions prior to 3.8.3, update to version 3.8.3 or later. For Cyrus IMAP versions 3.10.x prior to 3.10.0-rc1, update to version 3.10.0-rc1 or later. As a temporary workaround, consider restricting the number of LITERALs that can be sent in a single command to prevent unbounded memory allocation.