Courier IMAP versions prior to 6.0.1 and Courier Mail Server versions prior to 2.0.2 contain a vulnerability where the SEARCH command parser (specifically the alloc_search_key function in searchinfo.C) recursively processes nested parenthesized SEARCH queries without limiting recursion depth. This mutual recursion with alloc_search_andlist() and alloc_search_notkey() can be exploited by an authenticated IMAP user to send a single command with approximately 2500 nested parentheses, overflowing the 8MB stack and causing the imapd process to crash with a segmentation fault (SIGSEGV). The lack of an overall command line length limit facilitates exploitation.

An authenticated IMAP user can cause a denial of service by crashing the imapd process through sending a specially crafted SEARCH command with deeply nested parentheses. This results in service disruption but does not indicate privilege escalation or data compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is documented in the provided information. Until a patch is available, restrict authenticated user capabilities where possible and monitor for unusual SEARCH command usage patterns.