Homepage

Use of a Broken or Risky Cryptographic Algorithm The advisory has been revoked - it doesn't affect any version of package cyrus-imapd-2.4  (opens in a new tab)

Threat Intelligence

EPSS
3.1% (87th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1604-CYRUSIMAPD24-1618668
  • published21 Mar 2026
  • disclosed1 Sept 2021
Report a new vulnerability Found a mistake?

Introduced: 1 Sep 2021

CVE-2021-33582  (opens in a new tab)
CWE-327  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:16.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream cyrus-imapd-2.4 package and not the cyrus-imapd-2.4 package as distributed by Ubuntu.

Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.

References