cyrus-imapd - Debian Package Tracker

general

source: cyrus-imapd (main)
version: 3.12.3-1
maintainer: Debian Cyrus Team (DMD)
uploaders: Henrique de Moraes Holschuh [DMD] – Ondřej Surý [DMD] – Anthony Prades [DMD] – Yadd [DMD]
arch: all any
std-ver: 4.7.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 3.2.6-2+deb11u2
o-o-sec: 3.2.6-2+deb11u4
oldstable: 3.6.1-4+deb12u4
old-sec: 3.6.1-4+deb12u2
old-bpo: 3.10.1-3~bpo12+1
stable: 3.10.2-1
testing: 3.12.2-1
unstable: 3.12.3-1
exp: 3.12.1-1

versioned links

3.2.6-2+deb11u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.2.6-2+deb11u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.6.1-4+deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.6.1-4+deb12u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.8.1-1~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.10.0~beta1-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.10.0~rc2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.10.1-3~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.10.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.12.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.12.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.12.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

cyrus-admin (1 bugs: 0, 0, 1, 0)
cyrus-caldav (1 bugs: 0, 1, 0, 0)
cyrus-clients
cyrus-common
cyrus-dev
cyrus-doc
cyrus-imapd (9 bugs: 0, 6, 3, 0)
cyrus-murder
cyrus-nntpd
cyrus-pop3d
cyrus-replication (1 bugs: 0, 1, 0, 0)
libcyrus-imap-perl

action needed

9 security issues in trixie high

There are 9 open security issues in trixie.

9 important issues:

CVE-2026-47081: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create Apple Push Notification Service notifications for new mail in those mailboxes to their own APNS device. This did not leak any data about the content of mailboxes. Instead, a "mailbox has changed" notice would be pushed when the mailbox modseq changed.
CVE-2026-47082: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox.
CVE-2026-47083: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authenticated IMAP user could enumerate folder names under any account they could name. Search would return UIDs of messages matching the search, creating a content oracle (without allowing arbitrary reads of the target's content).
CVE-2026-47084: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypassed ACL checks. An authenticated but non-admin user could invoke the admin-only LOCALDELETE IMAP command and delete mailboxes for which they had no permissions.
CVE-2026-47085: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)
CVE-2026-47086: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions.
CVE-2026-47087: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.
CVE-2026-47088: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could craft an email message containing an RFC 822 comment ending with a backslash. When parsing the message, the server would read past the message's end in memory, and read into the heap, returning the read content to the user.
CVE-2026-47089: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. (This action should have been restricted to users with admin access on the target mailbox.)

Created: 2026-07-17 Last update: 2026-07-17 10:44

9 security issues in forky high

There are 9 open security issues in forky.

9 important issues:

CVE-2026-47081: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create Apple Push Notification Service notifications for new mail in those mailboxes to their own APNS device. This did not leak any data about the content of mailboxes. Instead, a "mailbox has changed" notice would be pushed when the mailbox modseq changed.
CVE-2026-47082: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox.
CVE-2026-47083: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authenticated IMAP user could enumerate folder names under any account they could name. Search would return UIDs of messages matching the search, creating a content oracle (without allowing arbitrary reads of the target's content).
CVE-2026-47084: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypassed ACL checks. An authenticated but non-admin user could invoke the admin-only LOCALDELETE IMAP command and delete mailboxes for which they had no permissions.
CVE-2026-47085: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)
CVE-2026-47086: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions.
CVE-2026-47087: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.
CVE-2026-47088: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could craft an email message containing an RFC 822 comment ending with a backslash. When parsing the message, the server would read past the message's end in memory, and read into the heap, returning the read content to the user.
CVE-2026-47089: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. (This action should have been restricted to users with admin access on the target mailbox.)

Created: 2026-07-17 Last update: 2026-07-17 10:44

10 security issues in bullseye high

There are 10 open security issues in bullseye.

9 important issues:

CVE-2026-47081: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create Apple Push Notification Service notifications for new mail in those mailboxes to their own APNS device. This did not leak any data about the content of mailboxes. Instead, a "mailbox has changed" notice would be pushed when the mailbox modseq changed.
CVE-2026-47082: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox.
CVE-2026-47083: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authenticated IMAP user could enumerate folder names under any account they could name. Search would return UIDs of messages matching the search, creating a content oracle (without allowing arbitrary reads of the target's content).
CVE-2026-47084: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypassed ACL checks. An authenticated but non-admin user could invoke the admin-only LOCALDELETE IMAP command and delete mailboxes for which they had no permissions.
CVE-2026-47085: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)
CVE-2026-47086: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions.
CVE-2026-47087: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.
CVE-2026-47088: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could craft an email message containing an RFC 822 comment ending with a backslash. When parsing the message, the server would read past the message's end in memory, and read into the heap, returning the read content to the user.
CVE-2026-47089: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. (This action should have been restricted to users with admin access on the target mailbox.)

1 ignored issue:

CVE-2024-34055: Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.

Created: 2026-07-17 Last update: 2026-07-17 10:44

9 security issues in bookworm high

There are 9 open security issues in bookworm.

9 important issues:

CVE-2026-47081: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create Apple Push Notification Service notifications for new mail in those mailboxes to their own APNS device. This did not leak any data about the content of mailboxes. Instead, a "mailbox has changed" notice would be pushed when the mailbox modseq changed.
CVE-2026-47082: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox.
CVE-2026-47083: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authenticated IMAP user could enumerate folder names under any account they could name. Search would return UIDs of messages matching the search, creating a content oracle (without allowing arbitrary reads of the target's content).
CVE-2026-47084: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypassed ACL checks. An authenticated but non-admin user could invoke the admin-only LOCALDELETE IMAP command and delete mailboxes for which they had no permissions.
CVE-2026-47085: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)
CVE-2026-47086: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions.
CVE-2026-47087: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.
CVE-2026-47088: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could craft an email message containing an RFC 822 comment ending with a backslash. When parsing the message, the server would read past the message's end in memory, and read into the heap, returning the read content to the user.
CVE-2026-47089: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. (This action should have been restricted to users with admin access on the target mailbox.)

Created: 2026-07-17 Last update: 2026-07-17 10:44

3 bugs tagged patch in the BTS normal

The BTS contains patches fixing 3 bugs, consider including or untagging them.

Created: 2026-06-02 Last update: 2026-07-18 09:13

Depends on packages which need a new maintainer normal

The packages that cyrus-imapd depends on which need a new maintainer are:

cunit (#1136394)
- Build-Depends: libcunit1-dev
db-defaults (#1055344)
- Depends: db-util

Created: 2022-07-05 Last update: 2026-07-18 07:00

Fails to build during reproducibility testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2026-07-04 Last update: 2026-07-18 06:31

RFH: The maintainer is looking for help with this package. normal

The current maintainer is looking for someone who can help with the maintenance of this package. If you are interested in this package, please consider helping out. One way you can help is offer to be a co-maintainer or triage bugs in the BTS. Please see bug number #921717 for more information.

Created: 2019-02-08 Last update: 2019-12-17 06:12

debian/patches: 1 patch to forward upstream low

Among the 7 debian patches available in version 3.12.3-1 of the package, we noticed the following issues:

1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-07-17 07:32

Issues found with some translations low

Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.

Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.

Created: 2026-03-31 Last update: 2026-03-31 12:00

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.3).

Created: 2026-03-31 Last update: 2026-07-17 06:20

testing migrations

This package will soon be part of the perl-5.42 transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-xapian-core transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
excuses:
- Migration status for cyrus-imapd (3.12.2-1 to 3.12.3-1): Waiting for test results or another package, or too young (no action required now - check later)
- Issues preventing migration:
- ∙ ∙ Lintian check waiting for test results - info
- ∙ ∙ Too young, only 1 of 5 days old
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/c/cyrus-imapd.html
- ∙ ∙ Autopkgtest for cyrus-imapd/3.12.3-1: amd64: Pass, arm64: Test triggered (failure will be ignored), loong64: Pass, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- Not considered

news

[rss feed]

[2026-07-16] Accepted cyrus-imapd 3.12.3-1 (source) into unstable (Bastian Germann) (signed by: bage@debian.org)
[2026-04-04] cyrus-imapd 3.12.2-1 MIGRATED to testing (Debian testing watch)
[2026-03-30] Accepted cyrus-imapd 3.12.2-1 (source) into unstable (Xavier Guimard)
[2026-01-11] cyrus-imapd 3.12.1-3 MIGRATED to testing (Debian testing watch)
[2026-01-05] Accepted cyrus-imapd 3.12.1-3 (source) into unstable (Bastian Germann) (signed by: bage@debian.org)
[2026-01-05] Accepted cyrus-imapd 3.6.1-4+deb12u4 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Sebastian Andrzej Siewior)
[2025-10-12] cyrus-imapd 3.12.1-2 MIGRATED to testing (Debian testing watch)
[2025-10-06] cyrus-imapd REMOVED from testing (Debian testing watch)
[2025-08-21] cyrus-imapd 3.12.1-2 MIGRATED to testing (Debian testing watch)
[2025-08-15] Accepted cyrus-imapd 3.12.1-2 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2025-07-17] cyrus-imapd 3.10.2-1 MIGRATED to testing (Debian testing watch)
[2025-06-27] Accepted cyrus-imapd 3.12.1-1 (source) into experimental (Yadd) (signed by: Xavier Guimard)
[2025-06-27] Accepted cyrus-imapd 3.10.2-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2025-05-26] Accepted cyrus-imapd 3.12.0-2 (source) into experimental (Yadd) (signed by: Xavier Guimard)
[2025-05-14] Accepted cyrus-imapd 3.10.1-3~bpo12+1 (source) into stable-backports (Yadd) (signed by: Xavier Guimard)
[2025-05-13] Accepted cyrus-imapd 3.12.0-1 (source) into experimental (Yadd) (signed by: Xavier Guimard)
[2025-04-24] cyrus-imapd 3.10.1-3 MIGRATED to testing (Debian testing watch)
[2025-04-12] Accepted cyrus-imapd 3.10.1-3 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2025-03-29] cyrus-imapd 3.10.1-2 MIGRATED to testing (Debian testing watch)
[2025-03-23] Accepted cyrus-imapd 3.10.1-2 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2025-02-02] cyrus-imapd 3.10.1-1 MIGRATED to testing (Debian testing watch)
[2025-01-22] Accepted cyrus-imapd 3.10.1-1 (source) into unstable (Xavier Guimard)
[2024-12-06] Accepted cyrus-imapd 3.2.6-2+deb11u4 (source) into oldstable-security (Lucas Kanashiro)
[2024-12-05] Accepted cyrus-imapd 3.2.6-2+deb11u3 (source) into oldstable-security (Lucas Kanashiro)
[2024-08-22] Accepted cyrus-imapd 3.6.1-4+deb12u3 (source) into proposed-updates (Debian FTP Masters) (signed by: Xavier Guimard)
[2024-08-19] Accepted cyrus-imapd 3.10.0-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2024-07-29] Accepted cyrus-imapd 3.10.0~rc2-1 (source) into experimental (Yadd) (signed by: Xavier Guimard)
[2024-07-29] Accepted cyrus-imapd 3.8.4-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2024-06-19] Accepted cyrus-imapd 3.6.1-2~bpo11+2 (source) into bullseye-backports (Debian FTP Masters) (signed by: Xavier Guimard)
[2024-06-12] Accepted cyrus-imapd 3.6.1-4+deb12u2 (source amd64 all) into proposed-updates (Debian FTP Masters) (signed by: Xavier Guimard)

bugs [bug history graph]

all: 15 16
RC: 0
I&N: 10
M&W: 5 6
F&P: 0
patch: 3

links

homepage
buildd: logs, exp, reproducibility, cross
popcon
browse source code
other distros
security tracker
l10n (100, -)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 3.12.2-1build1