{"id":"CVE-2021-33582","aliases":["CLSA-2022-1654106950","CLSA-2022-1654107183","CLSA-2022-1654174467","CLSA-2023-1688678110","CLSA-2026-1777279920","CLSA-2026-1777280127","CLSA-2026-1790640190","DEBIAN-CVE-2021-33582","DLA-3052-1","EUVD-2021-20268","GHSA-prxx-4m38-9m83","MGASA-2022-0247","RHSA-2021:3492","RHSA-2021:3493","RHSA-2021:3546","RLSA-2021:3492","UBUNTU-CVE-2021-33582","USN-7224-1","openSUSE-SU-2024:11901-1"],"status":"published","title":"Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute...","description":"Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.03095,"percentile":0.87903,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-327","CWE-407"],"published":"2021-09-01T00:00:00Z","modified":"2026-10-26T09:31:49Z","fixes":[{"ecosystem":"TuxCare:OracleLinux:6","package":"cyrus-imapd","fixed_in":["2.3.16-15.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"cyrus-imapd-devel","fixed_in":["2.3.16-15.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"cyrus-imapd-utils","fixed_in":["2.3.16-15.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"cyrus-imapd","fixed_in":["2.3.16-15.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"cyrus-imapd-devel","fixed_in":["2.3.16-15.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"cyrus-imapd-utils","fixed_in":["2.3.16-15.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-admin","fixed_in":["2.4.18-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-admin-2.4","fixed_in":["2.4.18-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-clients","fixed_in":["2.4.18-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-clients-2.4","fixed_in":["2.4.18-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-common","fixed_in":["2.4.18-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-common-2.4","fixed_in":["2.4.18-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-dev","fixed_in":["2.4.18-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-dev-2.4","fixed_in":["2.4.18-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-doc","fixed_in":["2.4.18-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-doc-2.4","fixed_in":["2.4.18-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-imapd","fixed_in":["2.4.18-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-imapd-2.4","fixed_in":["2.4.18-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-murder","fixed_in":["2.4.18-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-murder-2.4","fixed_in":["2.4.18-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-nntpd","fixed_in":["2.4.18-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-nntpd-2.4","fixed_in":["2.4.18-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-pop3d","fixed_in":["2.4.18-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-pop3d-2.4","fixed_in":["2.4.18-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-replication","fixed_in":["2.4.18-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-replication-2.4","fixed_in":["2.4.18-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libcyrus-imap-perl","fixed_in":["2.4.18-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libcyrus-imap-perl24","fixed_in":["2.4.18-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"cyrus-admin","fixed_in":["2.5.10-3ubuntu1.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"cyrus-caldav","fixed_in":["2.5.10-3ubuntu1.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"cyrus-clients","fixed_in":["2.5.10-3ubuntu1.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"cyrus-common","fixed_in":["2.5.10-3ubuntu1.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"cyrus-dev","fixed_in":["2.5.10-3ubuntu1.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"cyrus-doc","fixed_in":["2.5.10-3ubuntu1.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"cyrus-imapd","fixed_in":["2.5.10-3ubuntu1.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"cyrus-murder","fixed_in":["2.5.10-3ubuntu1.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"cyrus-nntpd","fixed_in":["2.5.10-3ubuntu1.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"cyrus-pop3d","fixed_in":["2.5.10-3ubuntu1.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"cyrus-replication","fixed_in":["2.5.10-3ubuntu1.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libcyrus-imap-perl","fixed_in":["2.5.10-3ubuntu1.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"cyrus-imapd","fixed_in":["2.4.17-15.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"cyrus-imapd-devel","fixed_in":["2.4.17-15.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"cyrus-imapd-utils","fixed_in":["2.4.17-15.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"cyrus-imapd","fixed_in":["2.4.17-15.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"cyrus-imapd-devel","fixed_in":["2.4.17-15.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"cyrus-imapd-utils","fixed_in":["2.4.17-15.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"cyrus-imapd","fixed_in":["2.4.17-15.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"cyrus-imapd-devel","fixed_in":["2.4.17-15.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"cyrus-imapd-utils","fixed_in":["2.4.17-15.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"cyrus-imapd","fixed_in":["3.4.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cyrus-imapd","fixed_in":["3.4.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cyrus-imapd","fixed_in":["3.4.2-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"cyrus-imapd","fixed_in":["2.5.15-3.1.mga8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cyrus-imapd","fixed_in":["0:3.0.7-20.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cyrus-imapd-debuginfo","fixed_in":["0:3.0.7-20.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cyrus-imapd-debugsource","fixed_in":["0:3.0.7-20.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cyrus-imapd-utils","fixed_in":["0:3.0.7-20.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cyrus-imapd-utils-debuginfo","fixed_in":["0:3.0.7-20.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cyrus-imapd-vzic","fixed_in":["0:3.0.7-20.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cyrus-imapd-vzic-debuginfo","fixed_in":["0:3.0.7-20.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"cyrus-imapd","fixed_in":["0:3.0.7-16.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"cyrus-imapd-debuginfo","fixed_in":["0:3.0.7-16.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"cyrus-imapd-debugsource","fixed_in":["0:3.0.7-16.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"cyrus-imapd-utils","fixed_in":["0:3.0.7-16.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"cyrus-imapd-utils-debuginfo","fixed_in":["0:3.0.7-16.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"cyrus-imapd-vzic","fixed_in":["0:3.0.7-16.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"cyrus-imapd-vzic-debuginfo","fixed_in":["0:3.0.7-16.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"cyrus-imapd","fixed_in":["0:3.0.7-16.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"cyrus-imapd-debuginfo","fixed_in":["0:3.0.7-16.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"cyrus-imapd-debugsource","fixed_in":["0:3.0.7-16.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"cyrus-imapd-utils","fixed_in":["0:3.0.7-16.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"cyrus-imapd-utils-debuginfo","fixed_in":["0:3.0.7-16.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"cyrus-imapd-vzic","fixed_in":["0:3.0.7-16.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"cyrus-imapd-vzic-debuginfo","fixed_in":["0:3.0.7-16.el8_1.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"cyrus-imapd","fixed_in":["0:3.0.7-20.el8_4.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cyrus-imapd","fixed_in":["2.5.10-3ubuntu1.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cyrus-imapd","fixed_in":["3.0.13-5ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cyrus-imapd","fixed_in":["2.4.22-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.16-15.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"cyrus-imapd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.16-15.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"cyrus-imapd-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.16-15.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.16-15.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"cyrus-imapd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.16-15.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"cyrus-imapd-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.16-15.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-admin-2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-clients-2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-common-2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-dev-2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-doc-2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-imapd-2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-murder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-murder-2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-nntpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-nntpd-2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-pop3d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-pop3d-2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-replication","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"cyrus-replication-2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcyrus-imap-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcyrus-imap-perl24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"cyrus-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.10-3ubuntu1.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"cyrus-caldav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.10-3ubuntu1.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"cyrus-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.10-3ubuntu1.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"cyrus-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.10-3ubuntu1.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"cyrus-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.10-3ubuntu1.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"cyrus-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.10-3ubuntu1.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.10-3ubuntu1.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"cyrus-murder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.10-3ubuntu1.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"cyrus-nntpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.10-3ubuntu1.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"cyrus-pop3d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.10-3ubuntu1.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"cyrus-replication","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.10-3ubuntu1.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libcyrus-imap-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.10-3ubuntu1.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17-15.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"cyrus-imapd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17-15.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"cyrus-imapd-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17-15.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17-15.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"cyrus-imapd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17-15.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"cyrus-imapd-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17-15.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17-15.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"cyrus-imapd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17-15.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"cyrus-imapd-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17-15.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.10-3+deb9u3"}]}],"versions":["2.5.10-3","2.5.10-3+deb9u1","2.5.10-3+deb9u2"],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.15-3.1.mga8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-20.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cyrus-imapd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-20.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cyrus-imapd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-20.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cyrus-imapd-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-20.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cyrus-imapd-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-20.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cyrus-imapd-vzic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-20.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cyrus-imapd-vzic-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-20.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-16.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"cyrus-imapd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-16.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"cyrus-imapd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-16.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"cyrus-imapd-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-16.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"cyrus-imapd-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-16.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"cyrus-imapd-vzic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-16.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"cyrus-imapd-vzic-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-16.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-16.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"cyrus-imapd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-16.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"cyrus-imapd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-16.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"cyrus-imapd-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-16.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"cyrus-imapd-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-16.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"cyrus-imapd-vzic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-16.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"cyrus-imapd-vzic-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-16.el8_1.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-20.el8_4.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"cyrus-imapd-2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.17+caldav~beta10-18","2.4.17+nocaldav-2","2.4.18-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.10-3ubuntu1.1+esm1"}]}],"versions":["2.5.10-3build1","2.5.10-3build2","2.5.10-3ubuntu1","2.5.10-3ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-5ubuntu0.1~esm1"}]}],"versions":["3.0.11-1","3.0.11-1build1","3.0.12-1","3.0.12-2","3.0.12-2ubuntu2","3.0.12-2ubuntu3","3.0.13-2ubuntu1","3.0.13-3ubuntu1","3.0.13-4ubuntu1","3.0.13-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.10-3ubuntu1.1+esm1"}]}],"versions":["2.5.10-3build1","2.5.10-3build2","2.5.10-3ubuntu1","2.5.10-3ubuntu1.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-5ubuntu0.1~esm1"}]}],"versions":["3.0.11-1","3.0.11-1build1","3.0.12-1","3.0.12-2","3.0.12-2ubuntu2","3.0.12-2ubuntu3","3.0.13-2ubuntu1","3.0.13-3ubuntu1","3.0.13-4ubuntu1","3.0.13-5"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-3ubuntu0.1+esm1"}]}],"versions":["3.2.6-2build1","3.4.2-2","3.4.2-2build1","3.4.3-2","3.4.3-3","3.4.3-3build2","3.4.3-3ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-1ubuntu0.1~esm1"}]}],"versions":["3.8.0-5","3.8.1-1","3.8.1-1build1","3.8.1-1build2","3.8.1-3","3.8.1-3build3","3.8.2-1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22-2.1"}]}]}],"products":[{"vendor":"cyrus","product":"imap"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://www.cyrusimap.org/imap/download/release-notes/index.html","tags":["x_refsource_MISC","x_transferred","Patch","Release Notes","Vendor Advisory","fix"]},{"url":"https://github.com/cyrusimap/cyrus-imapd/security/advisories","tags":["x_refsource_MISC","x_transferred","Not Applicable","Third Party Advisory","advisory"]},{"url":"https://github.com/cyrusimap/cyrus-imapd/commits/master","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://cyrus.topicbox.com/groups/announce/T3dde0a2352462975-M1386fc44adf967e072f8df13/cyrus-imap-3-4-2-3-2-8-and-3-0-16-released","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJZB45QBUN7CZFGOWCZYUYACNBTX7LVS/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HEO3RURJW6NLIXS7NK5PVU6MGHC4SCM/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/06/msg00013.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33582","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HEO3RURJW6NLIXS7NK5PVU6MGHC4SCM/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WJZB45QBUN7CZFGOWCZYUYACNBTX7LVS/"},{"url":"https://github.com/advisories/GHSA-prxx-4m38-9m83"},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2022-1654106950.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2022-1654107183.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04/CLSA-2022-1654174467","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18_04-els/CLSA-2023-1688678110","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1777279920.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1777280127.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1790640190.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-33582","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0247.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30079","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/WJZB45QBUN7CZFGOWCZYUYACNBTX7LVS/","tags":["web"]},{"url":"https://www.debian.org/lts/security/2022/dla-3052","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3492","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993232","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3492.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33582","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33582","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3493","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3493.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3546","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3546.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:3492","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-33582","tags":["report"]},{"url":"https://github.com/cyrusimap/cyrus-imapd/commit/93901789300aeefbe5c5829f2ab938e567a796dd","tags":["report"]},{"url":"https://github.com/cyrusimap/cyrus-imapd/commit/768b3aa4f51b636f0c591b6b34dd96aab9ce0136","tags":["report"]},{"url":"https://github.com/cyrusimap/cyrus-imapd/commit/3411deb448d29f4d287e90272dfa70d6f067ca67","tags":["report"]},{"url":"https://github.com/cyrusimap/cyrus-imapd/commit/810bb164a805395cd7a42412644f1d595e6b105e","tags":["report"]},{"url":"https://github.com/cyrusimap/cyrus-imapd/commit/943d4c37a063d2cf3384a88df9b884a167c04468","tags":["report"]},{"url":"https://www.cyrusimap.org/imap/download/release-notes/3.2/x/3.2.8.html","tags":["report"]},{"url":"https://www.cyrusimap.org/imap/download/release-notes/3.4/x/3.4.2.html","tags":["report"]},{"url":"https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.16.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7224-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-18928","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-34055","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33582","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-33582","description":"Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.","status":"published","published":"2021-09-01T05:32:49Z","modified":"2024-08-03T23:50:43.083Z","updated_at":"2026-11-02T14:33:10.204494Z"}],"euvd":[{"id":"EUVD-2021-20268","description":"Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.","status":"published","published":"2021-09-01T05:32:49Z","modified":"2024-08-03T23:50:43Z","updated_at":"2026-11-03T03:24:33.866739Z"}],"ghsa":[{"id":"GHSA-prxx-4m38-9m83","title":"Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute...","description":"Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.","status":"published","published":"2022-05-24T19:12:50Z","modified":"2023-01-27T05:03:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:42:10.172069Z"}],"nvd":[{"id":"CVE-2021-33582","description":"Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.","status":"published","published":"2021-09-01T06:15:06.387Z","modified":"2026-06-17T03:54:49.63Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:06:57.67549Z"}],"osv":[{"id":"CVE-2021-33582","description":"Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.","status":"published","published":"2021-09-01T06:15:06.387Z","modified":"2026-10-20T10:54:44.516969717Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:20.13324Z"},{"id":"DEBIAN-CVE-2021-33582","description":"Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.","status":"published","published":"2021-09-01T06:15:06.387Z","modified":"2026-10-23T18:04:50.395677117Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"RHSA-2021:3492","title":"Red Hat Security Advisory: cyrus-imapd security update","status":"published","published":"2024-09-16T06:24:38Z","modified":"2025-11-22T12:24:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3493","title":"Red Hat Security Advisory: cyrus-imapd security update","status":"published","published":"2024-09-16T06:24:31Z","modified":"2025-11-22T12:24:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3546","title":"Red Hat Security Advisory: cyrus-imapd security update","status":"published","published":"2024-09-16T06:24:44Z","modified":"2025-11-22T12:24:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:3492","title":"Important: cyrus-imapd security update","description":"The Cyrus IMAP server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contacts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols.\n\nSecurity Fix(es):\n\n* cyrus-imapd: Denial of service via string hashing algorithm collisions (CVE-2021-33582)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-09-13T06:47:39Z","modified":"2026-02-05T10:30:09.270589Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-33582","description":"Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.","status":"published","published":"2021-09-01T00:00:00Z","modified":"2026-04-22T12:53:56.475563Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:27.870979Z"},{"id":"CLSA-2022-1654106950","title":"Fixed CVE-2021-33582 in cyrus-imapd","description":"- CVE-2021-33582: Fix a bad string hashing algorithm which could lead to\n  collisions and cause a CPU denial of service","status":"published","published":"2022-06-01T18:09:10Z","modified":"2026-06-01T00:33:24.376782743Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1654107183","title":"Fixed CVE-2021-33582 in cyrus-imapd","description":"- CVE-2021-33582: Fix a bad string hashing algorithm which could lead to\n  collisions and cause a CPU denial of service","status":"published","published":"2022-06-01T18:13:03Z","modified":"2026-06-01T00:32:15.520101651Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1654174467","title":"Fix CVE(s): CVE-2021-33582","description":"\n   * SECURITY UPDATE: String hashing algorithm collisions\n     - debian/patches/CVE-2021-33582-pre.patch: gracefully handle lookup on\n       zero-sized tables\n     - debian/patches/CVE-2021-33582-1.patch: replace ad-hoc algorithm with\n       seeded djb2 in strhash\n     - debian/patches/CVE-2021-33582-2.patch: use a seed when hashing\n     - CVE-2021-33582","status":"published","published":"2022-06-02T12:54:27Z","modified":"2026-06-04T10:04:29.8656Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2023-1688678110","title":"Fix CVE(s): CVE-2021-33582","description":"\n   * SECURITY UPDATE: String hashing algorithm collisions\n     - debian/patches/0021-CVE-2021-33582-pre.patch: gracefully handle lookup on\n       zero-sized tables\n     - debian/patches/0022-CVE-2021-33582.patch: replace ad-hoc algorithm with\n       seeded djb2 and use it when hashing\n     - CVE-2021-33582\n   * Enable the internal cunit tests\n   * CUnit tests:\n     - debian/patches/0023-Add-unit-tests-for-strhash.patch: add unit tests for\n       strhash and hash quality\n     - debian/patches/0024-Skip-several-failed-tests.patch: skip several failed\n       tests","status":"published","published":"2023-07-06T21:15:14Z","modified":"2026-06-04T10:03:45.201765Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2026-1777279920","title":"cyrus-imapd: Fix of CVE-2021-33582","description":"- Fix CVE-2021-33582 - Denial of service via string hashing algorithm collisions","status":"published","published":"2026-04-27T08:52:08Z","modified":"2026-06-01T00:33:20.145131136Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777280127","title":"cyrus-imapd: Fix of CVE-2021-33582","description":"- Fix CVE-2021-33582 - Denial of service via string hashing algorithm collisions","status":"published","published":"2026-04-27T08:55:33Z","modified":"2026-06-01T00:33:27.16744956Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1790640190","title":"cyrus-imapd: Fix of CVE-2021-33582","description":"- Fix CVE-2021-33582 - Denial of service via string hashing algorithm collisions","status":"published","published":"2026-09-30T16:32:41Z","modified":"2026-10-26T09:31:49.530587029Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"DLA-3052-1","title":"cyrus-imapd - security update","status":"published","published":"2022-06-20T00:00:00Z","modified":"2026-03-09T01:19:06.875137Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2022-0247","title":"Updated cyrus-imapd packages fix security vulnerability","description":"Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of\nservice (multiple-minute daemon hang) via input that is mishandled during\nhash-table interaction. Because there are many insertions into a single\nbucket, strcmp becomes slow. (CVE-2021-33582)\n","status":"published","published":"2022-07-05T19:11:26Z","modified":"2026-04-16T04:43:04.762637715Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:11901-1","title":"cyradm-2.4.22-2.1 on GA media","description":"These are all security issues fixed in the cyradm-2.4.22-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:10:31.833689Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"USN-7224-1","title":"cyrus-imapd vulnerabilities","description":"It was discovered that non-authentication-related HTTP requests could be\ninterpreted in an authentication context by a Cyrus IMAP Server when\nmultiple requests arrived over the same connection. An unauthenticated\nattacker could possibly use this issue to perform a privilege escalation\nattack. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-18928)\n\nMatthew Horsfall discovered that Cyrus IMAP Server utilized a poor string\nhashing algorithm that could be abused to control where data was being\nstored. An attacker could possibly use this issue to perform a denial of\nservice. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.\n(CVE-2021-33582)\n\nDamian Poddebniak discovered that Cyrus IMAP Server could interpret\nspecially crafted commands to exploit a memory issue. An authenticated\nattacker could possibly use this issue to perform a denial of service.\nThis issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.\n(CVE-2024-34055)\n","status":"published","published":"2025-01-22T20:39:43Z","modified":"2026-04-27T17:47:18.183108286Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}