{"id":"CLSA-2026-1792122518","aliases":[],"status":"published","title":"Update of cyrus-imapd","description":"- fix NULL dereference in CalDAV VPATCH PATCHACTION string matching that\n  crashed the httpd worker on a property with an empty value","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-10-16T03:48:47Z","modified":"2026-10-26T09:30:15Z","fixes":[{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd","fixed_in":["3.4.1-7.el9_2.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd-devel","fixed_in":["3.4.1-7.el9_2.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd-doc-extra","fixed_in":["3.4.1-7.el9_2.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd-libs","fixed_in":["3.4.1-7.el9_2.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd-utils","fixed_in":["3.4.1-7.el9_2.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd-virusscan","fixed_in":["3.4.1-7.el9_2.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"perl-Cyrus","fixed_in":["3.4.1-7.el9_2.tuxcare.els4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-7.el9_2.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-7.el9_2.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd-doc-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-7.el9_2.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-7.el9_2.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-7.el9_2.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd-virusscan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-7.el9_2.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"perl-Cyrus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-7.el9_2.tuxcare.els4"}]}]}],"references":[{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792122518.html","tags":["advisory"]}],"sources":{"osv":[{"id":"CLSA-2026-1792122518","title":"Update of cyrus-imapd","description":"- fix NULL dereference in CalDAV VPATCH PATCHACTION string matching that\n  crashed the httpd worker on a property with an empty value","status":"published","published":"2026-10-16T03:48:47Z","modified":"2026-10-26T09:30:15.691108886Z","updated_at":"2026-11-02T15:43:50.949147Z"}]}}