cyrus-imapd - Debian Package Tracker

general

source: cyrus-imapd (main)
version: 3.12.3-3
maintainer: Debian Cyrus Team (DMD)
uploaders: Ondřej Surý [DMD] – Anthony Prades [DMD] – Yadd [DMD] – Henrique de Moraes Holschuh [DMD]
arch: all any
std-ver: 4.7.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 3.2.6-2+deb11u2
o-o-sec: 3.2.6-2+deb11u4
oldstable: 3.6.1-4+deb12u4
old-sec: 3.6.1-4+deb12u2
old-bpo: 3.10.2-1~bpo12+1
stable: 3.10.2-1
stable-bpo: 3.12.3-1~bpo13+1
stable-p-u: 3.10.2-1+deb13u1
testing: 3.12.3-2
unstable: 3.12.3-3

versioned links

3.2.6-2+deb11u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.2.6-2+deb11u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.6.1-4+deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.6.1-4+deb12u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.8.1-1~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.10.1-3~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.10.2-1~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.10.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.10.2-1+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.12.3-1~bpo13+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.12.3-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.12.3-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

cyrus-admin (1 bugs: 0, 0, 1, 0)
cyrus-caldav (1 bugs: 0, 1, 0, 0)
cyrus-clients
cyrus-common (1 bugs: 0, 0, 1, 0)
cyrus-dev
cyrus-doc
cyrus-imapd (7 bugs: 0, 5, 2, 0)
cyrus-murder
cyrus-nntpd
cyrus-pop3d
cyrus-replication (1 bugs: 0, 1, 0, 0)
libcyrus-imap-perl

action needed

Debci reports failed tests high

unstable: fail (log)
The tests ran in 0:14:32
Last run: 2026-08-08T01:18:22.000Z
Previous status: unknown

testing: pass (log)
The tests ran in 0:14:28
Last run: 2026-08-20T20:31:09.000Z
Previous status: unknown

stable: pass (log)
The tests ran in 0:14:53
Last run: 2026-07-18T08:05:58.000Z
Previous status: unknown

Created: 2026-08-08 Last update: 2026-08-24 09:32

Marked for autoremoval on 21 September due to clamav: #1143973, #1143939 high

Version 3.12.3-2 of cyrus-imapd is marked for autoremoval from testing on Mon 21 Sep 2026. It is affected by #1143973. It depends (transitively) on clamav, affected by #1143939. You should try to prevent the removal by fixing these RC bugs.

Created: 2026-08-15 Last update: 2026-08-24 09:02

10 security issues in bullseye high

There are 10 open security issues in bullseye.

9 important issues:

CVE-2026-47081: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create Apple Push Notification Service notifications for new mail in those mailboxes to their own APNS device. This did not leak any data about the content of mailboxes. Instead, a "mailbox has changed" notice would be pushed when the mailbox modseq changed.
CVE-2026-47082: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox.
CVE-2026-47083: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authenticated IMAP user could enumerate folder names under any account they could name. Search would return UIDs of messages matching the search, creating a content oracle (without allowing arbitrary reads of the target's content).
CVE-2026-47084: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypassed ACL checks. An authenticated but non-admin user could invoke the admin-only LOCALDELETE IMAP command and delete mailboxes for which they had no permissions.
CVE-2026-47085: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)
CVE-2026-47086: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions.
CVE-2026-47087: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.
CVE-2026-47088: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could craft an email message containing an RFC 822 comment ending with a backslash. When parsing the message, the server would read past the message's end in memory, and read into the heap, returning the read content to the user.
CVE-2026-47089: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. (This action should have been restricted to users with admin access on the target mailbox.)

1 ignored issue:

CVE-2024-34055: Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.

Created: 2026-07-17 Last update: 2026-08-18 01:00

9 security issues in bookworm high

There are 9 open security issues in bookworm.

9 important issues:

CVE-2026-47081: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create Apple Push Notification Service notifications for new mail in those mailboxes to their own APNS device. This did not leak any data about the content of mailboxes. Instead, a "mailbox has changed" notice would be pushed when the mailbox modseq changed.
CVE-2026-47082: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox.
CVE-2026-47083: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authenticated IMAP user could enumerate folder names under any account they could name. Search would return UIDs of messages matching the search, creating a content oracle (without allowing arbitrary reads of the target's content).
CVE-2026-47084: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypassed ACL checks. An authenticated but non-admin user could invoke the admin-only LOCALDELETE IMAP command and delete mailboxes for which they had no permissions.
CVE-2026-47085: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)
CVE-2026-47086: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions.
CVE-2026-47087: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.
CVE-2026-47088: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could craft an email message containing an RFC 822 comment ending with a backslash. When parsing the message, the server would read past the message's end in memory, and read into the heap, returning the read content to the user.
CVE-2026-47089: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. (This action should have been restricted to users with admin access on the target mailbox.)

Created: 2026-07-17 Last update: 2026-08-18 01:00

3 bugs tagged patch in the BTS normal

The BTS contains patches fixing 3 bugs, consider including or untagging them.

Created: 2026-08-15 Last update: 2026-08-24 09:30

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 5-day delay is over. Check why.

Created: 2026-08-23 Last update: 2026-08-24 09:01

Depends on packages which need a new maintainer normal

The packages that cyrus-imapd depends on which need a new maintainer are:

db-defaults (#1055344)
- Depends: db-util

Created: 2022-07-05 Last update: 2026-08-24 07:00

13 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 9aecd79c2e079d442b87eb751edaf5c030c7bd78
Merge: 7090066 4f9d5af
Author: Yadd <yadd@debian.org>
Date:   Mon Aug 24 06:52:27 2026 +0200

    Merge branch 'fix/standards-version-4.7.4' into 'master'
    
    Bump Standards-Version to 4.7.4 (no changes needed)
    
    See merge request debian/cyrus-imapd!15

commit 709006635c502b9849c336421f9620de7f67ff54
Merge: bc4e9f0 ccb1a6c
Author: Yadd <yadd@debian.org>
Date:   Mon Aug 24 06:52:10 2026 +0200

    Merge branch 'lintian-orig-tarball-signature' into 'master'
    
    Fix lintian: orig-tarball-missing-upstream-signature
    
    See merge request debian/cyrus-imapd!17

commit bc4e9f04aa70512f9a50898cde87e4ac2349d6ab
Merge: c8446f1 c84f21f
Author: Yadd <yadd@debian.org>
Date:   Mon Aug 24 06:50:44 2026 +0200

    Merge branch 'lintian-no-manual-page' into 'master'
    
    Fix lintian: no-manual-pages cyrdeliver cyrmaster
    
    See merge request debian/cyrus-imapd!19

commit c8446f1328c4280cdbec1194db200d260e99d80a
Merge: 019e728 9da543f
Author: Yadd <yadd@debian.org>
Date:   Mon Aug 24 06:49:42 2026 +0200

    Merge branch 'lintian-obsolete-doc-testdeps' into 'master'
    
    Fix lintian: testsuite-depends-on-obsolete-package AND Drop unused autopkgtest dependency 'texinfo'
    
    See merge request debian/cyrus-imapd!20

commit 019e7283eb2f6bdea86ea69937603044880fd732
Merge: d3ce4ca e145bb3
Author: Yadd <yadd@debian.org>
Date:   Mon Aug 24 06:49:09 2026 +0200

    Merge branch 'lintian-national-encoding' into 'master'
    
    Fix lintian: national-encoding
    
    See merge request debian/cyrus-imapd!21

commit d3ce4cad0a37f0dc45f90e871d2ae6e4cc391683
Merge: d50b2da e5ec485
Author: Yadd <yadd@debian.org>
Date:   Mon Aug 24 06:48:05 2026 +0200

    Merge branch 'fix/cyrus-common-cron-dependency' into 'master'
    
    Recommend cron | cron-daemon in cyrus-common
    
    See merge request debian/cyrus-imapd!23

commit c84f21f8945f37d0e567278365ff13b9ed0359df
Author: Edmund Lodewijks <edmund@proteamail.com>
Date:   Tue Aug 4 19:58:51 2026 +0200

    Fix lintian: no-manual-page cyrdeliver cyrmaster

commit e145bb37cef703149bc1006a5716c3cb3e55077a
Author: Edmund Lodewijks <edmund@proteamail.com>
Date:   Tue Aug 4 20:54:53 2026 +0200

    Fix lintian: national-encoding

commit e5ec485321bc21e363d973075a7d035a05b90dfb
Author: Edmund Lodewijks <edmund@proteamail.com>
Date:   Tue Aug 4 20:52:27 2026 +0200

    Recommend cron | cron-daemon in cyrus-common (Closes: #1143636)
    
    cyrus-common ships /etc/cron.daily/cyrus-imapd via dh_installcron but
    declares no dependency on a cron implementation at any strength, so the
    daily chk_cyrus consistency check silently never runs on a system without
    one installed.

commit 4f9d5af462c7a565d529a5370933758cdaf117a0
Author: Edmund Lodewijks <edmund@proteamail.com>
Date:   Tue Aug 4 21:08:44 2026 +0200

    Bump Standards-Version to 4.7.4 (no changes needed)

commit 9da543f76c73d36f1d0329560606918c55d022a9
Author: Edmund Lodewijks <edmund@proteamail.com>
Date:   Tue Aug 4 20:55:23 2026 +0200

    Drop unused autopkgtest dependency: texinfo
    
    Noticed while removing texi2html, which sits on the adjacent line of the
    same three files. Nothing in the tree uses it: there are no .texi or
    .texinfo sources, nothing under debian/ invokes makeinfo or install-info,
    and the only makeinfo references are autotools boilerplate plus the info
    target of the stock Sphinx docsrc/Makefile, which the build never calls.
    Debian's documentation is built from prebuilt HTML plus groff and pod2html
    in debian/rules.

commit ccb1a6cd5b6463f8e00d902b904feda21bf12aca
Author: Edmund Lodewijks <edmund@proteamail.com>
Date:   Tue Aug 4 20:53:23 2026 +0200

    Fix lintian: orig-tarball-missing-upstream-signature

commit b39bfa1127e285b075deb75ee6c2d76e2b8fa11a
Author: Edmund Lodewijks <edmund@proteamail.com>
Date:   Tue Aug 4 18:02:39 2026 +0200

    Fix lintian: testsuite-depends-on-obsolete-package

https://salsa.debian.org/api/v4/projects/debian%2Fcyrus-imapd API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-08-24 Last update: 2026-08-24 06:21

lintian reports 9 warnings normal

Lintian reports 9 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-08-01 Last update: 2026-08-18 06:19

RFH: The maintainer is looking for help with this package. normal

The current maintainer is looking for someone who can help with the maintenance of this package. If you are interested in this package, please consider helping out. One way you can help is offer to be a co-maintainer or triage bugs in the BTS. Please see bug number #921717 for more information.

Created: 2019-02-08 Last update: 2019-12-17 06:12

debian/patches: 2 patches to forward upstream low

Among the 8 debian patches available in version 3.12.3-3 of the package, we noticed the following issues:

2 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-08-18 06:30

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.3).

Created: 2026-03-31 Last update: 2026-08-17 21:19

testing migrations

This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-xapian-core transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
excuses:
- Migration status: Blocked. Can't migrate due to a non-migratable dependency. Check status below.
- Blocked by: perl
- Migration status for cyrus-imapd (3.12.3-2 to 3.12.3-3): BLOCKED: Cannot migrate due to another item, which is blocked (please check which dependencies are stuck)
- Issues preventing migration:
- ∙ ∙ Depends: cyrus-imapd perl (not considered)
- ∙ ∙ Invalidated by dependency
- Additional info (not blocking):
- ∙ ∙ Updating cyrus-imapd will fix bugs in testing: #1143973
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/c/cyrus-imapd.html
- ∙ ∙ Autopkgtest for cyrus-imapd/3.12.3-3: amd64: Pass, arm64: Test triggered (failure will be ignored), armhf: Pass, i386: Pass, ppc64el: Pass, s390x: Pass
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- ∙ ∙ 6 days old (needed 5 days)
- Not considered

news

[rss feed]

[2026-08-17] Accepted cyrus-imapd 3.12.3-3 (source) into unstable (Xavier Guimard)
[2026-08-06] cyrus-imapd 3.12.3-2 MIGRATED to testing (Debian testing watch)
[2026-07-31] Accepted cyrus-imapd 3.12.3-2 (source) into unstable (Bastian Germann) (signed by: bage@debian.org)
[2026-07-26] Accepted cyrus-imapd 3.10.2-1~bpo12+1 (source) into oldstable-backports (Bastian Germann) (signed by: bage@debian.org)
[2026-07-26] Accepted cyrus-imapd 3.10.2-1+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: bage@debian.org)
[2026-07-25] Accepted cyrus-imapd 3.12.3-1~bpo13+1 (source armhf all) into stable-backports (Debian FTP Masters) (signed by: bage@debian.org)
[2026-07-22] cyrus-imapd 3.12.3-1 MIGRATED to testing (Debian testing watch)
[2026-07-16] Accepted cyrus-imapd 3.12.3-1 (source) into unstable (Bastian Germann) (signed by: bage@debian.org)
[2026-04-04] cyrus-imapd 3.12.2-1 MIGRATED to testing (Debian testing watch)
[2026-03-30] Accepted cyrus-imapd 3.12.2-1 (source) into unstable (Xavier Guimard)
[2026-01-11] cyrus-imapd 3.12.1-3 MIGRATED to testing (Debian testing watch)
[2026-01-05] Accepted cyrus-imapd 3.12.1-3 (source) into unstable (Bastian Germann) (signed by: bage@debian.org)
[2026-01-05] Accepted cyrus-imapd 3.6.1-4+deb12u4 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Sebastian Andrzej Siewior)
[2025-10-12] cyrus-imapd 3.12.1-2 MIGRATED to testing (Debian testing watch)
[2025-10-06] cyrus-imapd REMOVED from testing (Debian testing watch)
[2025-08-21] cyrus-imapd 3.12.1-2 MIGRATED to testing (Debian testing watch)
[2025-08-15] Accepted cyrus-imapd 3.12.1-2 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2025-07-17] cyrus-imapd 3.10.2-1 MIGRATED to testing (Debian testing watch)
[2025-06-27] Accepted cyrus-imapd 3.12.1-1 (source) into experimental (Yadd) (signed by: Xavier Guimard)
[2025-06-27] Accepted cyrus-imapd 3.10.2-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2025-05-26] Accepted cyrus-imapd 3.12.0-2 (source) into experimental (Yadd) (signed by: Xavier Guimard)
[2025-05-14] Accepted cyrus-imapd 3.10.1-3~bpo12+1 (source) into stable-backports (Yadd) (signed by: Xavier Guimard)
[2025-05-13] Accepted cyrus-imapd 3.12.0-1 (source) into experimental (Yadd) (signed by: Xavier Guimard)
[2025-04-24] cyrus-imapd 3.10.1-3 MIGRATED to testing (Debian testing watch)
[2025-04-12] Accepted cyrus-imapd 3.10.1-3 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2025-03-29] cyrus-imapd 3.10.1-2 MIGRATED to testing (Debian testing watch)
[2025-03-23] Accepted cyrus-imapd 3.10.1-2 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2025-02-02] cyrus-imapd 3.10.1-1 MIGRATED to testing (Debian testing watch)
[2025-01-22] Accepted cyrus-imapd 3.10.1-1 (source) into unstable (Xavier Guimard)
[2024-12-06] Accepted cyrus-imapd 3.2.6-2+deb11u4 (source) into oldstable-security (Lucas Kanashiro)

bugs [bug history graph]

all: 14 15
RC: 0
I&N: 9
M&W: 5 6
F&P: 0
patch: 3

links

homepage
lintian (0, 9)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
l10n (100, -)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 3.12.2-1build1