CVE-2026-67194

Name of the Vulnerable Software and Affected Versions Courier IMAP versions prior to 6.0.1 Courier Mail Server versions prior to 2.0.2

Description Authenticated IMAP users can cause the imapd process to crash by sending deeply nested parenthesized SEARCH queries. The issue occurs because the SEARCH command parser, specifically the alloc search key() function in searchinfo.C, recursively processes nested parenthesized groups through a mutual recursion chain involving alloc search andlist() and alloc search notkey() without a depth limit. Since there is no overall command line length limit, a single IMAP command containing approximately 2500 nested parentheses can overflow the default 8MB stack, resulting in a SIGSEGV (segmentation fault), which is a specific error caused by accessing memory that the program does not have permission to access.

Recommendations Update Courier IMAP to version 6.0.1 or later. Update Courier Mail Server to version 2.0.2 or later.