{"id":"CVE-2026-67194","summary":"Courier IMAP \u003c 6.0.1 Mail Server \u003c 2.0.2 Stack Overflow DoS via Nested SEARCH Queries","details":"Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser (alloc_search_key in searchinfo.C) recursively descends on nested parenthesized groups through a mutual recursion chain with alloc_search_andlist() and alloc_search_notkey(), with no depth limit. Courier IMAP has no overall command line length limit, making exploitation trivial. A single IMAP command with ~2500 nested parentheses overflows the 8MB default stack, causing SIGSEGV.","modified":"2026-08-01T08:06:14.246878Z","published":"2026-07-29T16:39:09.617Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-674"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67194.json","unresolved_ranges":[{"extracted_events":[{"fixed":"6.0.1"},{"fixed":"2.0.2"}],"source":"AFFECTED_FIELD"},{"extracted_events":[{"fixed":"6.0.1"},{"fixed":"2.0.2"}],"source":"DESCRIPTION"}]},"references":[{"type":"WEB","url":"https://packages.debian.org/sid/courier-imap"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67194.json"},{"type":"ADVISORY","url":"https://github.com/svarshavchik/courier/releases/tag/courier%2F2.0.2%2F20260627214309"},{"type":"ADVISORY","url":"https://github.com/svarshavchik/courier/releases/tag/courier-imap%2F6.0.1%2F20260627214444"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67194"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/courier-imap-mail-server-stack-overflow-dos-via-nested-search-queries"},{"type":"FIX","url":"https://github.com/svarshavchik/courier-libs/commit/b5b5581aabea3efadf5e2944947ff0214aa3533e"},{"type":"PACKAGE","url":"https://github.com/svarshavchik/courier"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/svarshavchik/courier-libs","events":[{"introduced":"0"},{"fixed":"b5b5581aabea3efadf5e2944947ff0214aa3533e"}],"database_specific":{"source":"REFERENCES"}}],"versions":["maildrop/4.0.1/20260621223141","courier/2.0.1/20260621222951","sqwebmail/7.0.1/20260621223103","sqwebmail/7.0.0/20260620164452","maildrop/4.0.0/20260620164616","courier/2.0.0/20260620164119","courier-unicode/2.6.0/20260620163249","courier-sox/0.21/20260620164046","courier-imap/6.0.0/20260620164348","courier-authlib/0.73.0/20260620163941","courier-unicode/2.5.0/20260111200543","sqwebmail/6.3.1/20260111153507","maildrop/3.3.0/20260111153444","courier/1.6.0/20260111153226","courier-sox/0.20/20260111153438","courier-imap/5.3.2/20260111153337","courier-authlib/0.72.7/20260111153201","courier-authlib/0.72.6/20251109154458","sqwebmail/6.3.1/20251023215331","maildrop/3.2.1/20251023215516","courier/1.5.1/20251023214928","courier-imap/5.3.1/20251023215123","sqwebmail/6.3.0/20251016211734","maildrop/3.2.0/20251016211823","courier/1.5.0/20251016211441","courier-unicode/2.4.0/20251016211340","courier-imap/5.3.0/20251016211621","courier-authlib/0.72.5/20251016211408","courier/1.4.1/20250406143953","courier-imap/5.2.11/20250406143715","courier-unicode/2.3.2/20250406191735","courier-authlib/0.72.4/20250406143640","courier/1.4.0/20250316103417","courier/1.3.13/20240921094446","courier/1.3.12/20240831111910","courier-imap/5.2.10/20240831112031","sqwebmail/6.2.9/20240806074638","maildrop/3.1.8/20240806074759","courier/1.3.11/20240806074441","courier-unicode/2.3.1/20240806074415","courier-unicode/2.3.1/20240806074124","courier-unicode/2.3.1/20240806073712","courier-sox/0.19/20240806074431","courier-imap/5.2.9/20240806074556","courier-authlib/0.72.3/20240806075108","sqwebmail/6.2.8/20240720165950","courier/1.3.10/20240720165805","courier/1.3.9/20240714110903","courier-imap/5.2.7/20240714110618","maildrop/3.1.7/20240713092132","sqwebmail/6.2.7/20240511163149","courier/1.3.8/20240511163232","sqwebmail/6.2.6/20240423230632","courier/1.3.7/20240423220621","courier/1.3.7/20240423073735","courier-unicode/2.3.0/20240104213613","courier-authlib/0.72.1/20240130073737","sqwebmail/6.2.5/20231125103447","courier/1.3.5/20231125103240","courier-imap/5.2.6/20231125103405","courier-imap/5.2.5/20230828221040","sqwebmail/6.2.4/20230828203010","courier/1.3.4/20230828203057","sqwebmail/6.2.3/20230814090001","maildrop/3.1.6/20230814090338","courier/1.3.3/20230814090547","sqwebmail/6.2.2/20230602082020","courier/1.3.2/20230602081837","sqwebmail/6.2.1/20230601191748","courier/1.3.1/20230601191859","sqwebmail/6.2.0/20230531081841","courier/1.3.0/20230531081926","sqwebmail/6.1.2/20230429213739","maildrop/3.1.5/20230429221502","courier/1.2.4/20230429213520","courier-imap/5.2.4/20230429213643","maildrop/3.1.4/20230406203412","maildrop/3.1.3/20230406063650","sqwebmail/6.1.1/20230404203032","maildrop/3.1.2/20230404203122","courier/1.2.3/20230404081412","courier-imap/5.2.3/20230404202923","maildrop/3.1.1/20230219094055","courier/1.2.2/20230219094715","courier-imap/5.2.2/20230219094143","courier/1.2.1/20221217200325","courier-imap/5.2.1/20221217200828","sqwebmail/6.1.0/20221202210816","maildrop/3.1.0/20221202210755","courier/1.2.0/20221202210553","courier-unicode/2.2.6/20221202203250","courier-sox/0.18/20221202210750","courier-imap/5.2.0/20221202210713","courier-authlib/0.72.0/20221202210528","sqwebmail/6.0.11/20221114071756","maildrop/3.0.9/20221114071842","courier/1.1.11/20221114072017","courier-unicode/2.2.5/20221114071538","courier-sox/0.17/20221114073802","courier-imap/5.1.9/20221114071655","courier-authlib/0.71.6/20221114073152","courier/1.1.10/20220606180754","sqwebmail/6.0.10/20220531233348","maildrop/3.0.8/20220531232954","courier/1.1.9/20220531232250","courier-unicode/2.2.4/20220531234553","courier-sox/0.16/20220531232226","courier-imap/5.1.8/20220531232414","courier-authlib/0.71.5/20220531232155","courier-authlib/0.71.4/20220307203309","sqwebmail/6.0.9/20220116200148","maildrop/3.0.6/20220116200345","courier/1.1.8/20220116195856","courier-imap/5.1.7/20220116200038","sqwebmail/6.0.8/20220116155536","maildrop/3.0.5/20220116155756","courier/1.1.7/20220116155014","courier-imap/5.1.6/20220116155411","sqwebmail/6.0.7/20220116120232","maildrop/3.0.4/20220116120401","courier/1.1.6/20220116120022","courier-imap/5.1.5/20220116120150","courier/1.1.5/20210801125842","courier-imap/5.1.4/20210801130116","courier/1.1.4/20210518212001","courier/1.1.3/20210424125125","courier-imap/5.1.3/20210424125018","courier-authlib/0.71.3/20210412205815","courier/1.1.2/20210326200147","courier-imap/5.1.2/20210326200013","courier/1.1.1/20210320170424","courier-imap/5.1.1/20210320170246","sqwebmail/6.0.6/20210319214818","maildrop/3.0.3/20210319214705","courier/1.1.0/20210319215318","courier-unicode/2.2.2/20210319214424","courier-imap/5.1.0/20210319215058","courier-authlib/0.71.2/20210319214948","sqwebmail/6.0.5/20210209210407","courier/1.0.15/20210209205145","courier-imap/5.0.12/20210209210152","courier-authlib/0.71.1/20210209205029","maildrop/3.0.2/20210209215800","courier-sox/0.15/20210209215744","courier-unicode/2.1/20180918065012","maildrop/3.0.1/20200618220426","courier/1.0.14/20200618210330","courier-sox/0.14/20200618215757","courier-imap/5.0.11/20200618210620","courier-authlib/0.71.0/20200618210228","courier-sox/0.13/20200616202004","courier/1.0.13/20200424072124","courier/1.0.12/20200420082639","courier-imap/5.0.10/20200420082513","courier/1.0.11/20200420073456","courier-imap/5.0.9/20200419173038","courier/1.0.10/20200419171855","courier-authlib/0.70.0/20200419164631","sqwebmail/6.0.3/20190831135524","courier/1.0.9/20190831140324","courier-imap/5.0.8/20190831135704","sqwebmail/6.0.2/20190608084438","courier/1.0.8/20190608090758","courier-authlib/0.69.1/20190724201053","sqwebmail/6.0.1/20190608084158","sqwebmail/6.0.1/20190330184554","courier/1.0.7/20190608085611","courier/1.0.7/20190330184047","courier-imap/5.0.7/20190330184405","courier/1.0.6/20190130192956","courier-imap/5.0.6/20190130192542","courier/1.0.5/20181217190604","courier-imap/5.0.5/20181217190442","courier/1.0.4/20181128192349","courier-imap/5.0.4/20181128192207","courier/1.0.3/20181117093143","courier-imap/5.0.3/20181117093458","courier/1.0.2/20181027103012","courier-imap/5.0.2/20181027111303","courier/1.0.1/20181013160807","courier-imap/5.0.1/20181013160554","sqwebmail/6.0.0/20180917224034","maildrop/3.0.0/20180917224237","courier/1.0/20180917223614","courier-imap/5.0.0/20180917223909","courier-authlib/0.69.0/20180917223454","sqwebmail/5.9.2/20171203115438","maildrop/2.9.3/20171203115314","courier/0.78.2/20171203115636","sqwebmail/5.9.1/20171004194032","maildrop/2.9.2/20171005081210","maildrop/2.9.1/20171004194531","courier/0.78.1/20171004193712","courier-imap/4.18.2/20171004193929","maildrop/2.9.1/20171005071202","maildrop/2.9.1/20170819100311","courier/0.78.0/20170819100405","courier-imap/4.18.1/20170819100155","maildrop/2.9.0/20170702105314","sqwebmail/5.8.4/20170117205036","maildrop/2.8.5/20170117205233","courier/0.76.4/20170117203707","courier-imap/4.17.3/20170117204906","courier-authlib/0.67.0/20170128131141","maildrop/2.8.4/20160814100858","courier/0.76.3/20160917211918","courier/0.76.2/20160814100959","courier/0.76.2/20160814095637","courier-imap/4.17.2/20160814101108","courier-imap/4.17.2/20160814095842","courier/0.76.1/20160508090929","courier-imap/4.17.1/20160508091211","courier/0.76.0/20160426065735","courier-imap/4.17.0/20160426065621","courier-imap/4.16.2.20160306/20160307215443","courier-authlib/0.66.4/20151115120442","courier-unicode/1.4/20150906072833","sqwebmail/5.8.3/20150628231305","maildrop/2.8.3/20150628231513","courier/0.75.0/20150628230151","courier-unicode/1.3/20150628225959","courier-imap/4.16.2/20150628230425","courier-authlib/0.66.3/20150628230025","courier/0.74.2/20150427082630","courier/0.74.2/20150427082224","courier-imap/4.16.1/20150427082912","sqwebmail/5.8.2/20150427083025","maildrop/2.8.2/20150427083304","courier-unicode/1.2/20150427080712","courier-unicode/1.2/20150427080623","courier-authlib/0.66.2/20150427083605","sqwebmail/5.8.1/20141214081101","maildrop/2.8.1/20141214081550","courier/0.74.1/20141214080824","sqwebmail/5.8.0/20141213101603","maildrop/2.8.0/20141213101719","courier/0.74.0/20141213101233","courier-imap/4.16.0/20141213101457","maildrop/2.7.2/20140901092804","courier/0.73.2/20140901093012","sqwebmail/5.7.3/20140901092902","courier-imap/4.15.1/20140901094658","courier-unicode/1.1/20140622092444","courier-unicode/1.0/20140112161619","sqwebmail/5.7.2/20131223195015","courier/0.73.1/20131223194809","maildrop/2.7.1/20131128184356","courier/0.73/20131128185623","sqwebmail/5.7.1/20131128184237","courier-imap/4.15/20131128184113","courier-authlib/0.66.1/20131111193749","courier/0.72/20130928195848","courier-sox/0.12/20131006094016","courier-imap/4.14/20130928195544","courier-authlib/0.66.0/20130928223315","sqwebmail/5.7.0/20130928195718","maildrop/2.7.0/20130928195403"],"database_specific":{"vanir_signatures_modified":"2026-08-01T08:06:14Z","vanir_signatures":[{"digest":{"line_hashes":["324102191788101242559591669349694290702","35235881022085087855072741834168207339","22998871602831633174075279873829851744"],"threshold":0.9},"id":"CVE-2026-67194-50345343","signature_type":"Line","signature_version":"v1","source":"https://github.com/svarshavchik/courier-libs/commit/b5b5581aabea3efadf5e2944947ff0214aa3533e","target":{"file":"imap/searchinfo.h"},"deprecated":false}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67194.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}