CVE-2019-11356: Critical severity Cyrus IMAP vulnerability
Published Jun 3, 2019
·Updated
Last updated 25 August 2025
Other sources
The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.
— Launchpad
Affected Software
17 affected componentsFixes available
redhat/cyrus-imapd<2.5.13
2.5.13
redhat/cyrus-imapd<3.0.10
3.0.10
Cyrus IMAP>=2.5.0<=2.5.12
Cyrus IMAP>=3.0.0<=3.0.9
Fedoraproject Fedora=29
Fedoraproject Fedora=30
Debian Debian Linux=9.0
Canonical Ubuntu Linux=18.04
redhat Enterprise Linux=8.0
redhat Enterprise Linux Eus=8.1
redhat Enterprise Linux Eus=8.2
redhat Enterprise Linux Eus=8.4
redhat Enterprise Linux Server Aus=8.2
redhat Enterprise Linux Server Aus=8.4
redhat Enterprise Linux Server Tus=8.2
redhat Enterprise Linux Server Tus=8.4
debian/cyrus-imapd
3.2.6-2+deb11u23.2.6-2+deb11u43.6.1-4+deb12u43.6.1-4+deb12u23.10.2-13.12.1-3
Event History
Jun 3, 2019
CVE Published
via MITRE·07:44 PM
Data Sourced
via MITRE·07:44 PM
Description
Data Sourced
via NVD·08:29 PM
DescriptionSeverityWeaknessAffected Software
Feb 20, 2026
Data Sourced
via Ubuntu·10:21 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·10:22 PM
DescriptionAffected Software
Data Sourced
via Launchpad·10:22 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-11356?
CVE-2019-11356 is considered a critical vulnerability allowing for remote code execution.
2
How do I fix CVE-2019-11356?
To resolve CVE-2019-11356, upgrade to Cyrus IMAP version 2.5.13 or 3.0.10 or later.
3
What is the impact of CVE-2019-11356?
CVE-2019-11356 allows remote attackers to execute arbitrary code on the affected systems.
4
Which versions of Cyrus IMAP are affected by CVE-2019-11356?
CVE-2019-11356 affects Cyrus IMAP versions 2.5.x through 2.5.12 and 3.0.x through 3.0.9.
5
What types of attacks are associated with CVE-2019-11356?
CVE-2019-11356 is exploited via crafted HTTP PUT operations using long iCalendar property names.