CVE-2002-2253: Cyrus Libsieve

High severity, CVSS 10.0. EPSS: 6.6% chance of exploitation in the next 30 days.

Multiple buffer overflows in Cyrus Sieve / libSieve 2.1.2 and earlier allow remote attackers to execute arbitrary code via (1) a long header name, (2) a long IMAP flag, or (3) a script that generates a large number of errors that overflow the resulting error string.

Affected products

• Cyrus Libsieve: up to and including 2.1.2

Published 2002-12-31. Last modified 2026-06-16.