Every CVE Search/ Get API key

CVE-2019-11356

The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows...

9.8 CriticalFix available

The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

7.62%Up 2.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.

Record
CVE-2019-11356
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-787
Updated
2026-11-02
CVE List No score

The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.

Record
CVE-2019-11356
Updated
2026-11-02
EUVDEUVD-2019-3035 No score

The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.

Record
EUVD-2019-3035
Updated
2026-11-03
GitHub AdvisoriesGHSA-v5c4-xfxj-8x84 9.8

The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows...

The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.

Record
GHSA-v5c4-xfxj-8x84
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-119, CWE-787
Updated
2026-11-02
OSV 9.8

The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.

Record
CVE-2019-11356
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-11356 9.8

The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.

Record
DEBIAN-CVE-2019-11356
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVRHSA-2019:1771 5.6

Red Hat Security Advisory: cyrus-imapd security update

Record
RHSA-2019:1771
CVSS 3.0
5.6 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2019-11356 9.8

The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.

Record
UBUNTU-CVE-2019-11356
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2019-0219 No score

Updated cyrus-imapd packages fix security vulnerability

Updated cyrus-imapd package fixes security vulnerability:

It was discovered that cyrus-imapd had a buffer overflow in CalDAV request handling triggered by a long iCalendar property name (CVE-2019-11356).

Record
MGASA-2019-0219
Updated
2026-11-02
OSVopenSUSE-SU-2025:14968-1 No score

cyradm-3.8.4-1.1 on GA media

These are all security issues fixed in the cyradm-3.8.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14968-1
Updated
2026-11-02
OSVUSN-4566-1 No score

cyrus-imapd vulnerabilities

It was dicovered that Cyrus IMAP Server could execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name. An attacker could use this vulnerability to cause a crash or possibly execute arbitrary code. (CVE-2019-11356)

It was discovered that the Cyrus IMAP Server allow users to create any mailbox with administrative privileges. A local attacker could use this to obtain sensitive information. (CVE-2019-19783)

Record
USN-4566-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cyrus-imapd
Debian:12
 before 3.0.8-6
3.0.8-6
cyrus-imapd
Debian:13
 before 3.0.8-6
3.0.8-6
cyrus-imapd
Debian:14
 before 3.0.8-6
3.0.8-6
cyrus-imapd
Debian:9
 before 2.5.10-3+deb9u1, plus listed versions
2.5.10-3
2.5.10-3+deb9u1
cyrus-imapd
Mageia:6
 before 2.5.11-1.1.mga6
2.5.11-1.1.mga6
cyrus-imapd
Mageia:7
 before 2.5.11-7.1.mga7
2.5.11-7.1.mga7
cyrus-imapd
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.7-15.el8_0.1
0:3.0.7-15.el8_0.1
cyrus-imapd-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.7-15.el8_0.1
0:3.0.7-15.el8_0.1
cyrus-imapd-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.7-15.el8_0.1
0:3.0.7-15.el8_0.1
cyrus-imapd-utils
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.7-15.el8_0.1
0:3.0.7-15.el8_0.1
Show 6 moreShow less
Affected packages
PackageAffectedFixed
cyrus-imapd-utils-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.7-15.el8_0.1
0:3.0.7-15.el8_0.1
cyrus-imapd-vzic
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.7-15.el8_0.1
0:3.0.7-15.el8_0.1
cyrus-imapd-vzic-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.7-15.el8_0.1
0:3.0.7-15.el8_0.1
cyrus-imapd
Ubuntu:18.04:LTS
 before 2.5.10-3ubuntu1.1, plus listed versions
2.5.10-3build12.5.10-3build22.5.10-3ubuntu1
2.5.10-3ubuntu1.1
cyrus-imapd
Ubuntu:18.04:LTS
From an advisory covering 2 CVEs
 before 2.5.10-3ubuntu1.1, plus listed versions
2.5.10-3build12.5.10-3build22.5.10-3ubuntu1
2.5.10-3ubuntu1.1
cyrus-imapd
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 3.8.4-1.1
3.8.4-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-11356 is a critical vulnerability (CVSS 9.8) in Cyrus Imap, published June 3, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.62%, the 94th percentile. Fixed in cyrus-imapd 3.0.8-6.

References

Show 24 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open