Vulnerabilities

CVE-2026-61915 is a double-free (CWE-415) in the VPATCH BYPARAM handling of Cyrus IMAP's CalDAV support, fixed in version 3.12.4. An authenticated calendar user triggers it by sending a PATCH request with PATCH-ACTION="BYPARAM@..." against a resource containing two or more properties of the matched kind, which frees the memory holding the selector once on each iteration over the properties. The result is a crash of the CalDAV worker process — a denial-of-service condition with high availability impact, no confidentiality impact, and only low integrity impact per the CVSS score of 7.1. Any Cyrus IMAP deployment before 3.12.4 with the CalDAV/calendar component enabled and reachable by authenticated users is affected. There is currently no public proof-of-concept, no CISA KEV listing, and EPSS assigns only a 0.2% probability of exploitation within 30 days.

Do: Upgrade Cyrus IMAP to 3.12.4 or later. Where immediate upgrade is not possible, restrict CalDAV access to trusted authenticated accounts, monitor CalDAV worker (httpd) processes for repeated crashes or restarts, and consider blocking calendar PATCH requests carrying PATCH-ACTION="BYPARAM@..." at a fronting proxy or disabling the calendar service until patched.