CVE-2026-61915

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties.

• fix CVE-2026-61915: double-free in the CalDAV VPATCH BYPARAM selector
• fix CVE-2026-61909: calendar/addressbook-multiget returned resources the user has no ACL on
• fix CVE-2026-61911: Sieve mailboxexists/metadata probed other users' mailboxes without a lookup-rights check
• do not free VPATCH parameters already removed by reference: libical frees them in icalproperty_remove_parameter_by_ref(), so the following icalparameter_free() aborted the CalDAV worker on any VPATCH carrying a PATCH-ACTION parameter, before the CVE-2026-61915 code path could be reached
• add the upstream cunit regression test for CVE-2026-61915
• run the cunit suite in %check even when cassandane is disabled, so the regression test above actually executes

• fix CVE-2026-61915: double-free in the CalDAV VPATCH BYPARAM selector, reachable by an authenticated calendar user patching a resource with two or more properties of the matched kind
• disable the cassandane test runner by default: its harness (imaptest plus the perl test modules) is absent from the el8 repositories on every architecture, and where it does resolve the suite times out in the build chroot; the cunit suite continues to run on all architectures
• do not free VPATCH parameters already removed by reference: libical frees them in icalproperty_remove_parameter_by_ref(), so the following icalparameter_free() aborted the CalDAV worker on any VPATCH carrying a PATCH-ACTION parameter, before the CVE-2026-61915 code path could be reached

• fix CVE-2026-61915: double-free in the CalDAV VPATCH BYPARAM selector, reachable by an authenticated calendar user patching a resource with two or more properties of the matched kind
• do not free VPATCH parameters already removed by reference: the parameter stays owned by libical after icalproperty_remove_parameter_by_ref(), so the following icalparameter_free() double-freed it and aborted the CalDAV worker on any VPATCH carrying a PATCH-ACTION parameter
• use strcmpsafe/strncmpsafe for PATCHACTION string matching: icalparameter_get_xvalue() and icalproperty_get_value_as_string() may return NULL on the same VPATCH path
• disable the cassandane test runner by default: on i686 its noarch perl dependencies are absent from the i686 mirror of centos8.4-Devel, and on x86_64 the prebuilt imaptest helper dies on SIGBUS (769 run, 0 failures, 64 errors, all the same crash); the cunit suite continues to run on both architectures

• use strcmpsafe/strncmpsafe for VPATCH PATCHACTION string matching: icalproperty_get_value_as_string() returns NULL for a property parsed with an empty value, so a VPATCH carrying 'SUMMARY;PATCH-ACTION=BYVALUE:' crashed the httpd worker on the same authenticated CalDAV path as CVE-2026-61915

• use strcmpsafe/strncmpsafe for VPATCH PATCHACTION string matching: icalproperty_get_value_as_string() returns NULL for a property parsed with an empty value, so a VPATCH carrying 'SUMMARY;PATCH-ACTION=BYVALUE:' crashed the httpd worker on the same authenticated CalDAV path as CVE-2026-61915

• fix CVE-2026-61915: double-free in the CalDAV VPATCH BYPARAM selector, reachable by an authenticated calendar user patching a resource with two or more properties of the matched kind
• disable the cassandane test runner by default: its harness (imaptest plus the perl test modules) is absent from the centos-stream8 repositories on every architecture; the cunit suite continues to run on all architectures
• do not free VPATCH parameters already removed by reference: the parameter stays owned by libical after icalproperty_remove_parameter_by_ref(), so the following icalparameter_free() double-freed it and aborted the CalDAV worker on any VPATCH carrying a PATCH-ACTION parameter, before the CVE-2026-61915 code path could be reached
• use strcmpsafe/strncmpsafe for PATCHACTION string matching: icalparameter_get_xvalue() and icalproperty_get_value_as_string() may return NULL on the same VPATCH path

• fix CVE-2026-61915: double-free in the CalDAV VPATCH BYPARAM selector
• do not free VPATCH parameters already removed by reference, which aborted the CalDAV worker before the CVE-2026-61915 path was reached
• add the upstream cunit regression test for CVE-2026-61915

• SECURITY UPDATE: Double free in CalDAV VPATCH BYPARAM handling
  • debian/patches/CVE-2026-61915-pre.patch: do not free the PATCH-ACTION parameter already freed by icalproperty_remove_parameter_by_ref()
  • debian/patches/CVE-2026-61915.patch: free the BYPARAM selector once after the property loop in apply_property_updates()
  • CVE-2026-61915

• SECURITY UPDATE: double free in CalDAV VPATCH BYPARAM handling
  • debian/patches/CVE-2026-61915-pre.patch: do not free the PATCH-ACTION parameter already freed by icalproperty_remove_parameter_by_ref()
  • debian/patches/CVE-2026-61915.patch: free the BYPARAM selector once after the property loop in apply_property_updates()
  • CVE-2026-61915

This update for cyrus-imapd fixes the following issues:

Changes in cyrus-imapd:

Update to 3.8.8 (bugfix release):

• CVE-2026-61907: JMAP snooze bypasses destination-mailbox ACL (bsc#1279908)
• CVE-2026-61908: JMAP email-header blob ID out-of-bounds index (bsc#1279975)
• CVE-2026-61909: CalDAV/CardDAV multiget bypasses per-href ACL (bsc#1279976)
• CVE-2026-61910: Mailbox/set let sharee change special-use role on shared mailboxes (bsc#1279977)
• CVE-2026-61911: Sieve mailbox existence oracle (bsc#1279978)
• CVE-2026-61915: VPATCH BYPARAM double-free (bsc#1279979)