CVE-2026-61915: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-61915 is a double-free memory vulnerability (CWE-415) in the CalDAV component of Cyrus IMAP, specifically in the VPATCH BYPARAM handling. An authenticated calendar user can crash a Cyrus CalDAV worker process by sending a PATCH request with PATCH-ACTION="BYPARAM@..." against a resource containing two or more properties of the matched kind, causing the selector memory to be freed once per property iteration. Affected versions include Cyrus IMAP before 3.8.8, 3.9.0–3.10.3, and 3.11.0–3.12.3. It carries a CVSS v3.1 base score of 4.2 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a double-free condition (CWE-415) in Cyrus IMAP's CalDAV VPATCH processing logic. When a PATCH request specifies PATCH-ACTION="BYPARAM@..." and the target CalDAV resource has two or more properties matching the selector criteria, the code iterates over each matching property and frees the selector memory on every iteration rather than once, resulting in a double-free. Exploitation requires network access and low-privilege authentication (a valid calendar user account), but no user interaction. The attack complexity is rated High, reflecting the need to craft a specific resource state with multiple matching properties (GitHub Advisory, Red Hat Bugzilla).

The primary impact is denial of service: an authenticated attacker can crash the Cyrus CalDAV worker process, causing service unavailability for calendar users. Beyond availability, the double-free memory corruption condition may theoretically enable memory manipulation that could lead to arbitrary code execution or data integrity issues within the CalDAV service, though no such exploitation has been demonstrated. Confidentiality impact is rated None, while both integrity and availability are rated Low (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. Exploitation requires authenticated access as a calendar user, which limits the attacker pool (GitHub Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify a Cyrus IMAP server running a vulnerable version (before 3.8.8, 3.9.x before 3.10.4, or 3.11.x before 3.12.4) with CalDAV enabled and accessible over the network.
2. Authentication: Obtain or use existing low-privilege calendar user credentials to authenticate to the CalDAV service.
3. Prepare target resource: Ensure or identify a CalDAV resource (e.g., a calendar event) that contains two or more properties of the same kind that would be matched by the BYPARAM selector.
4. Craft malicious PATCH request: Send an HTTP PATCH request to the target CalDAV resource with a body specifying PATCH-ACTION="BYPARAM@..." targeting the property type present multiple times in the resource.
5. Trigger double-free: The server iterates over each matching property and frees the selector memory on each iteration, triggering the double-free condition and crashing the CalDAV worker process (GitHub Advisory).

• Logs: Unexpected Cyrus CalDAV worker process crashes or restarts in system logs (e.g., /var/log/syslog, /var/log/cyrus/ logs); error messages related to memory corruption or segmentation faults in Cyrus IMAP logs.
• Network: Repeated HTTP PATCH requests to CalDAV endpoints from a single authenticated user, particularly targeting the same calendar resource; requests containing PATCH-ACTION="BYPARAM@..." in the request body.
• Process: Abnormal termination of cyrus worker processes (e.g., imapd, httpd CalDAV workers) with signal 11 (SIGSEGV) or signal 6 (SIGABRT) indicating memory corruption.

Upgrade Cyrus IMAP to a patched version: 3.8.8 or later (for the 3.8.x branch), 3.10.4 or later (for the 3.10.x branch), or 3.12.4 or later (for the 3.12.x branch). If immediate patching is not feasible, restrict CalDAV access to trusted and known users only, and monitor Cyrus worker process logs for unexpected crashes or anomalous PATCH requests. Release notes for the fixed versions are available from the Cyrus IMAP project (GitHub Advisory).