CyberRota Analysis
AI-GeneratedCyrus IMAP versions prior to 3.12.4 are vulnerable to a double-free memory issue that can be exploited by authenticated calendar users. By sending a specially crafted PATCH request with multiple properties, an attacker can crash the Cyrus CalDAV worker, potentially disrupting service availability. Organizations using affected versions should prioritize patching to mitigate this vulnerability and maintain service stability.
Original NVD Description
An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties.