CVE-2024-34055

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-05 · updated 2026-06-17
Weakness: CWE-770

Description

Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.

Affected products

cyrusimap Cyrus Imap: before 3.8.3; 3.10.0-alpha0, 3.10.0-beta1, 3.10.0-beta2 — fixed in 3.8.3

How to fix

Upgrade to a fixed version: cyrusimap Cyrus Imap 3.8.3. Check the vendor advisory for mitigations.

References

https://github.com/cyrusimap/cyrus-imapd/commit/ef9e4e8314d6a06f2269af0ccf606894cc3fe489
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJZQAE3XC2GBCE5KSTWJ5A6QYANFWGFB/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WVZHUZDU4MGTTZJRNACTMSKXLNMMRLJ6/
https://www.cyrusimap.org/dev/imap/download/release-notes/3.10/x/3.10.0-rc1.html
https://www.cyrusimap.org/imap/download/release-notes/3.8/x/3.8.3.html
https://github.com/cyrusimap/cyrus-imapd/commit/ef9e4e8314d6a06f2269af0ccf606894cc3fe489
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJZQAE3XC2GBCE5KSTWJ5A6QYANFWGFB/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WVZHUZDU4MGTTZJRNACTMSKXLNMMRLJ6/
https://www.cyrusimap.org/dev/imap/download/release-notes/3.10/x/3.10.0-rc1.html
https://www.cyrusimap.org/imap/download/release-notes/3.8/x/3.8.3.html

Get alerted when CVE-2024-34055 or the next vulnerability affects your stack