Cyrusimap
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Cyrusimap product.
RSS Feeds for Cyrusimap security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Cyrusimap products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Cyrusimap Sorted by Most Security Vulnerabilities since 2018
By the Year
In 2025 there have been 0 vulnerabilities in Cyrusimap. Last year, in 2024 Cyrusimap had 1 security vulnerability published. Right now, Cyrusimap is on track to have less security vulnerabilities in 2025 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2025 | 0 | 0.00 |
| 2024 | 1 | 6.50 |
| 2023 | 0 | 0.00 |
| 2022 | 1 | 8.80 |
| 2021 | 0 | 0.00 |
| 2020 | 0 | 0.00 |
| 2019 | 1 | 7.50 |
| 2018 | 0 | 0.00 |
It may take a day or so for new Cyrusimap vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Cyrusimap Security Vulnerabilities
Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1
CVE-2024-34055
6.5 - Medium
- June 05, 2024
Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.
Allocation of Resources Without Limits or Throttling
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28
CVE-2022-24407
8.8 - High
- February 24, 2022
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.
SQL Injection
cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP
CVE-2019-19906
7.5 - High
- December 19, 2019
cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.
Memory Corruption
Multiple buffer overflows in Cyrus SASL library 2.1.9 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) long inputs during user name canonicalization, (2) characters
CVE-2002-1347
9.8 - Critical
- December 18, 2002
Multiple buffer overflows in Cyrus SASL library 2.1.9 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) long inputs during user name canonicalization, (2) characters that need to be escaped during LDAP authentication using saslauthd, or (3) an off-by-one error in the log writer, which does not allocate space for the null character that terminates a string.
Incorrect Calculation of Buffer Size