CVE-2026-61915 is a medium severity (CVSS 4.2) double-free in the CalDAV code of Cyrus IMAP before 3.12.4. An authenticated calendar user can crash a CalDAV worker with a crafted PATCH request. The Cyrus project fixed it in 3.12.4, and its release notes also list the fix in the 3.10.4 release.
What's affected
The record says Cyrus IMAP before 3.12.4 is affected. The issue is a CWE-415 double-free in the VPATCH BYPARAM handling: when a resource has two or more properties of the matched kind, the memory holding the selector is freed once on each pass over the properties.
Fixed releases named in the sources:
- Cyrus IMAP 3.12.4 (release notes list this CVE under security fixes)
- Cyrus IMAP 3.10.4 (release notes list it too)
- Cyrus IMAP 3.8.8 (the record links to these release notes, which were not retrieved for this review, so confirm the entry there)
The attack needs a logged in calendar user and the CVSS vector marks attack complexity as high, which is why the score stays in the medium band. The impact in the vector is a limited integrity and availability effect, not a full compromise.
How to check if you're exposed
Find the version your servers run, then compare it with the fixed releases for your series.
cyrus-imapd --version 2>/dev/null || imapd -V
rpm -q cyrus-imapd 2>/dev/null
dpkg -s cyrus-imapd 2>/dev/null | grep Version
The exact command depends on how you installed it. Distribution packages often backport fixes without changing the upstream version number, so a version string below 3.12.4 on a packaged install does not by itself prove exposure. Check your distribution's security tracker for this CVE id.
Also confirm whether CalDAV is enabled at all. If the httpd service for CalDAV is not running, the vulnerable path is not reachable from the network.
Whatever the product, a current inventory of what you run is what turns a CVE notice into a quick answer. The Gold page for this CVE tracks how its record changes over time, and the free in-browser dependency scan at gold.safeguard.sh/scan covers the application libraries you ship.
What to do now
- Identify every Cyrus IMAP instance and which release series it runs (3.12, 3.10 or 3.8).
- Upgrade to 3.12.4, 3.10.4 or 3.8.8 or later in the same series, or install your distribution's patched package.
- Restart the Cyrus services so the new binaries are in use.
- If you cannot patch yet, limit CalDAV access to trusted networks and accounts. The advisory describes an authenticated attack, so reducing who can log in reduces exposure.
- Watch the logs for repeated CalDAV worker crashes, which is the visible effect described in the advisory.
Why it matters
A double-free means the same block of memory is released twice. The allocator's bookkeeping is then corrupted, and in the worst cases that can be shaped into more than a crash. The advisory for this CVE only describes a crash of a CalDAV worker, and this page makes no claim beyond that. The weakness class is CWE-415.
The root cause is a loop that frees a shared selector on every iteration instead of once after the loop. It is a small coding slip with a clear fix, but the lesson is general: ownership of memory must be settled before a loop starts. The record does not list this CVE as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Do I need to patch if nobody uses CalDAV?
Unpatched software is still worth updating, but the described attack goes through CalDAV PATCH requests from an authenticated user. If CalDAV is not enabled, that path is not reachable, so this one is lower priority than for servers that expose calendars.
Sources
Last reviewed: 18 October 2026.
