CVE-2011-3481: Cmu Cyrus Imap Server

Medium severity, CVSS 4.3. EPSS: 2.1% chance of exploitation in the next 30 days.

The index_get_ids function in index.c in imapd in Cyrus IMAP Server before 2.4.11, when server-side threading is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted References header in an e-mail message.

Affected products

• Cmu Cyrus Imap Server: up to and including 2.4.10; version 2.0.17 only; version 2.1.16 only; version 2.1.17 only; version 2.1.18 only; version 2.2.8 only; …

Published 2011-09-14. Last modified 2026-06-16.