CVE-2026-67194 describes a denial-of-service vulnerability in Courier IMAP and Courier Mail Server caused by uncontrolled recursion in the SEARCH command parser. The parser functions alloc_search_key, alloc_search_andlist, and alloc_search_notkey recursively process nested parenthesized SEARCH queries without limiting recursion depth. Since Courier IMAP imposes no overall command line length limit, an attacker with authenticated IMAP access can send a single SEARCH command with approximately 2500 nested parentheses, overflowing the 8MB stack and crashing the imapd process via a segmentation fault.

An authenticated IMAP user can cause a denial-of-service condition by crashing the imapd process, disrupting mail service availability. There is no indication of privilege escalation, data disclosure, or code execution. The impact is limited to service interruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting authenticated user access or limiting the complexity of SEARCH queries if possible.