CVE-2026-61915: Cyrus IMAP Use-After-Free Vulnerability

CVE-2026-61915 Overview

Cyrus IMAP versions prior to 3.12.4 contain a double-free vulnerability in the CalDAV worker's handling of VPATCH calendar operations. An authenticated calendar user can trigger the flaw by sending a PATCH request containing a PATCH-ACTION="BYPARAM@..." directive against a resource that has two or more properties of the matched kind. The memory holding the selector is freed once on each iteration over the matched properties, causing a double-free condition [CWE-415].

Critical Impact
An authenticated calendar user can crash the Cyrus CalDAV worker process, disrupting calendar service availability for users of the affected server.

Affected Products

Cyrus IMAP versions prior to 3.8.8
Cyrus IMAP versions prior to 3.10.4
Cyrus IMAP versions prior to 3.12.4

Discovery Timeline

2026-09-09 - CVE CVE-2026-61915 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-61915

Vulnerability Analysis

The vulnerability resides in the Cyrus IMAP CalDAV worker, which processes RFC 5995 style PATCH operations against calendar resources. When a client submits a VPATCH document with a PATCH-ACTION="BYPARAM@..." selector, the server iterates over each property on the target resource that matches the specified kind. During each iteration, the code releases the memory backing the selector string.

When the target resource contains two or more matching properties, the loop reaches the second iteration and frees the same allocation a second time. This creates a classic double-free condition, corrupting the allocator's internal metadata and terminating the CalDAV worker process.

Exploitation requires valid authentication to the CalDAV service and the ability to store a calendar resource with multiple properties of a matched kind. No user interaction is needed once the crafted PATCH request is issued. The impact is limited to availability of the CalDAV worker and any integrity effects tied to abnormal termination mid-operation.

Root Cause

The root cause is improper lifecycle management of a heap-allocated selector buffer inside the BYPARAM property iteration loop. The free() call should occur once after the loop completes, but it is executed inside the per-property iteration, releasing the same pointer on every pass.

Attack Vector

The attack vector is network-based over the CalDAV HTTP interface. An authenticated user issues a PATCH request with a VPATCH body specifying PATCH-ACTION="BYPARAM@..." targeting a calendar object containing multiple properties of the same kind. The worker process handling the request crashes when the double-free is triggered.

No verified public exploit code is available. Refer to the Cyrus IMAP 3.12.4 Release Notes for upstream remediation details.

Detection Methods for CVE-2026-61915

Indicators of Compromise

Unexpected termination or restart of Cyrus CalDAV worker processes correlated with recent PATCH requests.
HTTP PATCH requests to CalDAV endpoints containing VPATCH bodies with PATCH-ACTION="BYPARAM@ selectors.
Segmentation faults or glibc double-free diagnostics in syslog originating from httpd or Cyrus IMAP service processes.

Detection Strategies

Parse Cyrus IMAP access logs for PATCH methods against /dav/calendars/ URIs and inspect payloads for BYPARAM action selectors.
Alert on repeated CalDAV worker crashes within a short interval originating from a single authenticated principal.
Monitor operating system core dump generation and systemd service restart counters for the Cyrus IMAP unit.

Monitoring Recommendations

Enable verbose CalDAV request logging and forward logs to a centralized analytics platform for correlation with process crash events.
Track authentication events tied to CalDAV sessions that immediately precede worker termination.
Baseline normal PATCH request volume per user to surface anomalous spikes consistent with abuse attempts.

How to Mitigate CVE-2026-61915

Immediate Actions Required

Upgrade Cyrus IMAP to version 3.12.4, 3.10.4, or 3.8.8 depending on the deployed release branch.
Audit CalDAV user accounts and disable or rotate credentials for any principals that are unused or shared.
Enable service supervision so the CalDAV worker restarts automatically after a crash while patching is scheduled.

Patch Information

Upstream fixes are published in the Cyrus IMAP 3.8.8, 3.10.4, and 3.12.4 releases. Review the Cyrus IMAP 3.12.4 Release Notes, Cyrus IMAP 3.10.4 Release Notes, and Cyrus IMAP 3.8.8 Release Notes before deployment.

Workarounds

Restrict CalDAV access at the network layer to trusted client subnets until patches are deployed.
Temporarily disable the CalDAV module in the Cyrus configuration if calendar functionality is not required.
Front the CalDAV endpoint with a reverse proxy that rejects PATCH requests containing PATCH-ACTION="BYPARAM payloads.

bash

# Example nginx rule to block VPATCH BYPARAM requests pending patch deployment
location /dav/calendars/ {
    if ($request_method = PATCH) {
        set $block 1;
    }
    if ($http_content_type ~* "application/vpatch\+xml|text/calendar") {
        set $block "${block}1";
    }
    if ($block = 11) {
        return 405;
    }
    proxy_pass http://cyrus_backend;
}