CVE-2026-67194: Courier IMAP DoS Vulnerability

CVE-2026-67194 Overview

CVE-2026-67194 is a stack overflow vulnerability in Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2. Authenticated IMAP users can crash the imapd process by sending SEARCH commands containing deeply nested parenthesized groups. The alloc_search_key function in searchinfo.C recursively descends on nested parentheses through a mutual recursion chain with alloc_search_andlist() and alloc_search_notkey(), without enforcing a depth limit. Courier IMAP imposes no overall command line length limit, which makes triggering the condition straightforward. A single command with roughly 2,500 nested parentheses exhausts the default 8MB stack and causes a SIGSEGV. The flaw is tracked as [CWE-674: Uncontrolled Recursion].

Critical Impact
Authenticated attackers can crash the Courier IMAP daemon on demand, producing a denial-of-service condition against mail server availability.

Affected Products

Courier IMAP versions before 6.0.1
Courier Mail Server versions before 2.0.2
Debian packages shipping affected courier-imap builds

Discovery Timeline

2026-07-29 - CVE-2026-67194 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-67194

Vulnerability Analysis

The vulnerability resides in the IMAP SEARCH command parser inside searchinfo.C. When parsing a SEARCH key, alloc_search_key() calls alloc_search_andlist() for parenthesized groups and alloc_search_notkey() for negated keys. Each of these functions can call back into alloc_search_key(), forming a mutual recursion chain. Because the parser applies no depth limit, each level of nested parentheses consumes an additional stack frame. The daemon runs with an 8MB default stack, which is exhausted at roughly 2,500 nesting levels.

Root Cause

The root cause is uncontrolled recursion [CWE-674] in the SEARCH command parser. The mutual recursion between alloc_search_key(), alloc_search_andlist(), and alloc_search_notkey() grows linearly with input nesting depth. Courier IMAP also lacks any overall command line length cap, so an attacker can submit arbitrarily long SEARCH expressions in a single command.

Attack Vector

An authenticated IMAP user connects to the server and issues a single SEARCH command containing approximately 2,500 opening parentheses. Parsing that input drives the recursion chain past the process stack limit, producing a SIGSEGV in imapd. The attack requires only low-privileged IMAP credentials and no user interaction.

text

// Patch excerpt from imap/ChangeLog
+6.0.1
+
+2026-06-26  Sam Varshavchik  <mrsam@courier-mta.com>
+
+	* searchinfo.C: Hard cap on limit-less IMAP constructs, to return
+	an error instead of exhausting stack or heap.
+
 6.0.0

 2026-05-24  Sam Varshavchik  <mrsam@courier-mta.com>

Source: GitHub Commit b5b5581

Detection Methods for CVE-2026-67194

Indicators of Compromise

Repeated SIGSEGV termination of imapd child processes correlated with authenticated IMAP sessions.
IMAP session logs showing unusually long SEARCH commands or long runs of ( characters from a single client.
Sudden spikes in IMAP connection resets or client reconnect loops following a SEARCH command.

Detection Strategies

Monitor Courier logs for imapd crashes tied to a specific authenticated user or source IP.
Alert on IMAP commands whose line length or parenthesis count exceeds a defined threshold at the network or proxy layer.
Inspect kernel messages or systemd journal entries for segmentation faults in imapd processes.

Monitoring Recommendations

Track per-user IMAP command failure and disconnect rates to surface abusive accounts.
Enable core dump collection on the mail host to confirm stack exhaustion in alloc_search_key frames.
Correlate authentication logs with imapd termination events to identify the originating account.

How to Mitigate CVE-2026-67194

Immediate Actions Required

Upgrade Courier IMAP to version 6.0.1 or later and Courier Mail Server to 2.0.2 or later.
Rotate or disable IMAP credentials associated with suspicious SEARCH activity.
Restrict IMAP access to trusted networks where operationally feasible.

Patch Information

The fix is included in Courier IMAP 6.0.1 and Courier 2.0.2. The upstream commit adds a hard cap on limit-less IMAP constructs so the parser returns an error instead of exhausting stack or heap. See the VulnCheck Security Advisory and the Debian Package Information for distribution updates.

Workarounds

Place an IMAP-aware proxy or firewall in front of imapd to cap command line length and reject SEARCH commands with excessive parenthesis nesting.
Lower the per-process stack limit and enable automatic service restart so a crash does not leave the mail store unreachable for long periods.
Disable or rate-limit IMAP access for accounts that do not require it, reducing the pool of authenticated actors who can trigger the flaw.

bash

# Verify installed Courier IMAP version and upgrade on Debian-based systems
dpkg -l | grep -E 'courier-imap|courier-mta'
sudo apt update && sudo apt install --only-upgrade courier-imap courier-mta
systemctl restart courier-imap