{"id":"CVE-2024-34055","aliases":["ALSA-2024:9195","CLSA-2026-1779119949","DEBIAN-CVE-2024-34055","DSA-5708-1","EUVD-2024-35154","GHSA-crp5-539g-qwq6","RHSA-2024:9195","RLSA-2024:9195","UBUNTU-CVE-2024-34055","USN-7224-1","openSUSE-SU-2025:14968-1"],"status":"published","title":"Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause...","description":"Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00836,"percentile":0.58035,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2024-06-05T00:00:00Z","modified":"2026-11-02T12:02:31Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"cyrus-imapd","fixed_in":["3.4.8-1.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"cyrus-imapd-libs","fixed_in":["3.4.8-1.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"cyrus-imapd-utils","fixed_in":["3.4.8-1.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"perl-Cyrus","fixed_in":["3.4.8-1.el9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd","fixed_in":["3.4.1-7.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd-devel","fixed_in":["3.4.1-7.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd-doc-extra","fixed_in":["3.4.1-7.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd-libs","fixed_in":["3.4.1-7.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd-utils","fixed_in":["3.4.1-7.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd-virusscan","fixed_in":["3.4.1-7.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"perl-Cyrus","fixed_in":["3.4.1-7.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"cyrus-imapd","fixed_in":["3.6.1-4+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cyrus-imapd","fixed_in":["3.8.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cyrus-imapd","fixed_in":["3.8.3-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cyrus-imapd","fixed_in":["0:3.4.8-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cyrus-imapd-debuginfo","fixed_in":["0:3.4.8-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cyrus-imapd-debugsource","fixed_in":["0:3.4.8-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cyrus-imapd-libs","fixed_in":["0:3.4.8-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cyrus-imapd-libs-debuginfo","fixed_in":["0:3.4.8-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cyrus-imapd-utils","fixed_in":["0:3.4.8-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cyrus-imapd-utils-debuginfo","fixed_in":["0:3.4.8-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cyrus-imapd-virusscan-debuginfo","fixed_in":["0:3.4.8-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-Cyrus","fixed_in":["0:3.4.8-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-Cyrus-debuginfo","fixed_in":["0:3.4.8-1.el9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"cyrus-imapd","fixed_in":["0:3.4.8-1.el9"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"cyrus-imapd","fixed_in":["3.4.3-3ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"cyrus-imapd","fixed_in":["3.8.2-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.8-1.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cyrus-imapd-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.8-1.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cyrus-imapd-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.8-1.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"perl-Cyrus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.8-1.el9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-7.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-7.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd-doc-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-7.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-7.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-7.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd-virusscan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-7.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"perl-Cyrus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-7.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-4+deb12u2"}]}],"versions":["3.6.1-4","3.6.1-4+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.3-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-4+deb12u2"}]}],"versions":["3.6.1-4","3.6.1-4+deb12u1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.8-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cyrus-imapd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.8-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cyrus-imapd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.8-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cyrus-imapd-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.8-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cyrus-imapd-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.8-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cyrus-imapd-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.8-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cyrus-imapd-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.8-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cyrus-imapd-virusscan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.8-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-Cyrus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.8-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-Cyrus-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.8-1.el9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.8-1.el9"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"cyrus-imapd-2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.17+caldav~beta10-18","2.4.17+nocaldav-2","2.4.18-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.10-3build1","2.5.10-3build2","2.5.10-3ubuntu1","2.5.10-3ubuntu1.1","2.5.10-3ubuntu1.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.11-1","3.0.11-1build1","3.0.12-1","3.0.12-2","3.0.12-2ubuntu2","3.0.12-2ubuntu3","3.0.13-2ubuntu1","3.0.13-3ubuntu1","3.0.13-4ubuntu1","3.0.13-5","3.0.13-5ubuntu0.1~esm1","3.0.13-5ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-3ubuntu0.1+esm1"}]}],"versions":["3.2.6-2build1","3.4.2-2","3.4.2-2build1","3.4.3-2","3.4.3-3","3.4.3-3build2","3.4.3-3ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-1ubuntu0.1~esm1"}]}],"versions":["3.8.0-5","3.8.1-1","3.8.1-1build1","3.8.1-1build2","3.8.1-3","3.8.1-3build3","3.8.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.10-3ubuntu1.1+esm1"}]}],"versions":["2.5.10-3build1","2.5.10-3build2","2.5.10-3ubuntu1","2.5.10-3ubuntu1.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-5ubuntu0.1~esm1"}]}],"versions":["3.0.11-1","3.0.11-1build1","3.0.12-1","3.0.12-2","3.0.12-2ubuntu2","3.0.12-2ubuntu3","3.0.13-2ubuntu1","3.0.13-3ubuntu1","3.0.13-4ubuntu1","3.0.13-5"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-3ubuntu0.1+esm1"}]}],"versions":["3.2.6-2build1","3.4.2-2","3.4.2-2build1","3.4.3-2","3.4.3-3","3.4.3-3build2","3.4.3-3ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-1ubuntu0.1~esm1"}]}],"versions":["3.8.0-5","3.8.1-1","3.8.1-1build1","3.8.1-1build2","3.8.1-3","3.8.1-3build3","3.8.2-1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.4-1.1"}]}],"bundled":4}],"products":[{"vendor":"cyrusimap","product":"cyrus_imap"}],"references":[{"url":"https://github.com/cyrusimap/cyrus-imapd/commit/ef9e4e8314d6a06f2269af0ccf606894cc3fe489","tags":["x_transferred","Patch","Release Notes","fix","article"]},{"url":"https://www.cyrusimap.org/imap/download/release-notes/3.8/x/3.8.3.html","tags":["x_transferred","Release Notes","web","article"]},{"url":"https://www.cyrusimap.org/dev/imap/download/release-notes/3.10/x/3.10.0-rc1.html","tags":["x_transferred","Release Notes","web","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJZQAE3XC2GBCE5KSTWJ5A6QYANFWGFB/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WVZHUZDU4MGTTZJRNACTMSKXLNMMRLJ6/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34055","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJZQAE3XC2GBCE5KSTWJ5A6QYANFWGFB"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WVZHUZDU4MGTTZJRNACTMSKXLNMMRLJ6"},{"url":"https://github.com/advisories/GHSA-crp5-539g-qwq6"},{"url":"https://access.redhat.com/errata/RHSA-2024:9195","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-34055","tags":["report"]},{"url":"https://bugzilla.redhat.com/2290510","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-9195.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1779119949.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34055.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-34055","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2290510","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-6509","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9195.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-34055","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2024:9195","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-34055","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7224-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-18928","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-33582","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34055","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-34055","description":"Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.","status":"published","published":"2024-06-05T00:00:00Z","modified":"2024-12-06T14:30:51.894Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:34:23.193864Z"}],"euvd":[{"id":"EUVD-2024-35154","description":"Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.","status":"published","published":"2024-06-05T00:00:00Z","modified":"2024-12-06T14:30:51Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:04:39.149757Z"}],"ghsa":[{"id":"GHSA-crp5-539g-qwq6","title":"Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause...","description":"Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.","status":"published","published":"2024-06-05T06:30:39Z","modified":"2024-06-14T06:34:46Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:57:29.798871Z"}],"nvd":[{"id":"CVE-2024-34055","description":"Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.","status":"published","published":"2024-06-05T05:15:49.95Z","modified":"2026-06-17T07:32:49.277Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:10:03.465199Z"}],"osv":[{"id":"CVE-2024-34055","description":"Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.","status":"published","published":"2024-06-05T00:00:00Z","modified":"2026-10-28T02:30:31.976740687Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"DEBIAN-CVE-2024-34055","description":"Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.","status":"published","published":"2024-06-05T05:15:49.95Z","modified":"2026-11-02T12:02:31.760867948Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"RHSA-2024:9195","title":"Red Hat Security Advisory: cyrus-imapd security update","status":"published","published":"2024-11-12T18:04:17Z","modified":"2026-03-18T11:36:21.936538Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"UBUNTU-CVE-2024-34055","description":"Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.","status":"published","published":"2024-06-05T00:00:00Z","modified":"2026-04-22T14:50:05.15438Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:50.784131Z"},{"id":"ALSA-2024:9195","title":"Moderate: cyrus-imapd security update","description":"The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and SIEVE support.  \n\nSecurity Fix(es):  \n\n  * cyrus-imapd: unbounded memory allocation by sending many LITERALs in a single command (CVE-2024-34055)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.\n","status":"published","published":"2024-11-12T00:00:00Z","modified":"2026-10-29T11:31:10.386833345Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"CLSA-2026-1779119949","title":"cyrus-imapd: Fix of CVE-2024-34055","description":"- fix CVE-2024-34055: denial of service via memory exhaustion using oversized IMAP literals and command arguments\n- disable cassandane test runner on x86_64 and aarch64 due to multiple unrelated mock-environment issues (imaptest binary SIGSEGV, slow file I/O, alarm scheduling races); cunit which exercises the CVE fix continues to run on all arches","status":"published","published":"2026-05-19T00:34:02Z","modified":"2026-06-01T00:32:33.685640692Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"DSA-5708-1","title":"cyrus-imapd - security update","status":"published","published":"2024-06-11T00:00:00Z","modified":"2026-03-09T02:11:37.977713Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"openSUSE-SU-2025:14968-1","title":"cyradm-3.8.4-1.1 on GA media","description":"These are all security issues fixed in the cyradm-3.8.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-04-04T00:00:00Z","modified":"2026-02-04T04:07:09.050202Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"RLSA-2024:9195","title":"Moderate: cyrus-imapd security update","description":"The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and SIEVE support.\n\nSecurity Fix(es):\n\n* cyrus-imapd: unbounded memory allocation by sending many LITERALs in a single command (CVE-2024-34055)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.","status":"published","published":"2025-03-17T20:16:49.937392Z","modified":"2026-02-04T13:15:06.106684Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"USN-7224-1","title":"cyrus-imapd vulnerabilities","description":"It was discovered that non-authentication-related HTTP requests could be\ninterpreted in an authentication context by a Cyrus IMAP Server when\nmultiple requests arrived over the same connection. An unauthenticated\nattacker could possibly use this issue to perform a privilege escalation\nattack. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-18928)\n\nMatthew Horsfall discovered that Cyrus IMAP Server utilized a poor string\nhashing algorithm that could be abused to control where data was being\nstored. An attacker could possibly use this issue to perform a denial of\nservice. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.\n(CVE-2021-33582)\n\nDamian Poddebniak discovered that Cyrus IMAP Server could interpret\nspecially crafted commands to exploit a memory issue. An authenticated\nattacker could possibly use this issue to perform a denial of service.\nThis issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.\n(CVE-2024-34055)\n","status":"published","published":"2025-01-22T20:39:43Z","modified":"2026-04-27T17:47:18.183108286Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}