CVE-2021-33582: Cyrus Imap

High severity, CVSS 7.5. EPSS: 3.1% chance of exploitation in the next 30 days.

Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.

Affected products

• Cyrus Imap: before 3.0.16 (fixed in 3.0.16); from 3.2.0, before 3.2.8 (fixed in 3.2.8); from 3.4.0, before 3.4.2 (fixed in 3.4.2)
• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 34 only; version 35 only

Published 2021-09-01. Last modified 2026-06-17.