Cyrus IMAP Vulnerability in CalDAV Worker Causing Double-Free Issue

CVE-2026-61915

What is CVE-2026-61915?

A vulnerability has been identified in Cyrus IMAP versions prior to 3.12.4 that affects authenticated calendar users. This issue involves a double-free scenario triggered when a PATCH request with PATCH-ACTION='BYPARAM@...' is executed on resources having two or more matched properties. The flaw can lead to the crashing of the CalDAV worker, resulting from the memory associated with the selector being improperly freed in multiple iterations. It is crucial for users of affected versions to apply the latest updates to mitigate this risk.

References