Courier IMAP and Courier Mail Server versions prior to 6.0.1 and 2.0.2 contain a stack‑overflow flaw that occurs when an authenticated IMAP client sends a SEARCH command containing deep nesting of parenthesized search keys. The recursive descent parser in alloc_search_key, along with alloc_search_andlist() and alloc_search_notkey(), has no explicit depth limit, allowing an attacker to craft a single command with roughly 2,500 nested parentheses that overwhelms the 8 MB default stack and triggers a segmentation fault. The resulting crash causes the imapd process to terminate, temporarily disrupting service for all users and representing a denial‑of‑service vulnerability classified under CWE‑674.

The affected software is Courier IMAP distributed by svarshavchik, which implements the IMAP protocol. The vulnerability also exists in Courier Mail Server, the companion POP3/SMTP service, from the same vendor. Any installation running Courier IMAP version 5.x or earlier, or Courier Mail Server version 1.x or earlier, is affected. Upgrading to the public releases 6.0.1 for Courier IMAP and 2.0.2 for Courier Mail Server removes the flaw.

The CVSS score of 7.1 indicates a high impact denial‑of‑service risk. The EPSS score is less than 1%, suggesting that exploitation is relatively rare, and the vulnerability is not currently listed in CISA’s KEV catalog. Attackers would need authenticated IMAP access, but once credentials are obtained they can deploy the nested SEARCH query to trigger the crash. The lack of a depth or line‑length limit means the attack can be executed trivially once the connection is established, with no external network restrictions required.