CVE-2026-67194

CVE-2026-67194 is a stack overflow in Courier's IMAP server triggered by deeply nested SEARCH queries. The vulnerable code lives in three mutually recursive functions—alloc_search_key(), alloc_search_andlist(), and alloc_search_notlist()—that parse IMAP SEARCH commands without any recursion depth tracking. Send a SEARCH query with roughly 2500 characters of nested AND/NOT operators and the parser will overflow its stack and crash. Any authenticated user can trigger this; no special privileges required. What makes this worth more than a routine patch is the architectural context. These three functions call each other with no depth counter, guard, or command length limit anywhere in the call chain. This wasn't an oversight in one function—it reflects a parser designed with the assumption that the caller provides well-formed input. That assumption has no place in an internet-facing IMAP server, and the question is whether other command parsers in Courier share the same flaw. Check your Courier IMAP deployment immediately: version 6.0.1 and later for Courier IMAP, 2.0.2 and later for Courier Mail Server contain the fix. However, verify whether your patch added depth limiting only to the SEARCH parser or represents a broader audit. If it's a one-off fix, the same unbounded-recursion pattern likely exists elsewhere—grep for mutual recursion in other command handlers, particularly AUTHENTICATE, envelope parsing, and folder management. The blast radius is nontrivial: while process-per-connection architecture limits each crash to one session, any authenticated user can repeatedly crash the service, making this a viable availability attack vector against the entire mail system.

Reviewed through automated stages and approved by a human before publication.