What’s Vulnerable › Vulnerabilities

CVE-2021-26911

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-02-17 · updated 2026-06-17
• Weakness: CWE-295

Description

core/imap/MCIMAPSession.cpp in Canary Mail before 3.22 has Missing SSL Certificate Validation for IMAP in STARTTLS mode.

Affected products

• Canarymail Canary Mail: 3.20, 3.21
• Libmailcore Mailcore2: 0.6.4

References

• http://www.openwall.com/lists/oss-security/2021/02/17/3
• https://apps.apple.com/us/app/canary-mail/id1236045954
• https://census-labs.com/news/2021/02/17/canary-mail-app-missing-certificate-validation-check-on-imap-starttls/
• https://census-labs.com/news/category/advisories/
• https://github.com/canarymail/mailcore2/commit/45acb4efbcaa57a20ac5127dc976538671fce018
• https://www.openwall.com/lists/oss-security/2021/02/17/3
• http://www.openwall.com/lists/oss-security/2021/02/17/3
• https://apps.apple.com/us/app/canary-mail/id1236045954
• https://census-labs.com/news/2021/02/17/canary-mail-app-missing-certificate-validation-check-on-imap-starttls/
• https://census-labs.com/news/category/advisories/
• https://github.com/canarymail/mailcore2/commit/45acb4efbcaa57a20ac5127dc976538671fce018
• https://www.openwall.com/lists/oss-security/2021/02/17/3

Get alerted when CVE-2021-26911 or the next vulnerability affects your stack