This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-61908 →

DEBIAN-CVE-2026-61908

An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could att...

Original description

The description as published by the source.

An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H-, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 cyrus-imapd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 cyrus-imapd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 cyrus-imapd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.4-1"}]}]

References

advisory security-tracker.debian.org