# CVE-2025-23394: cyrus-imapd: This update for cyrus-imapd fixes the following issues:  Changes in cyrus-imapd:  - cyrus-imapd don't start because o...

CVE-2025-23394 is fixed in cyrus-imapd on 1 platform by OPENSUSE-SU-2026:20962-1 (version 3.8.6-bp160.1.1), released June 12, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2025-23394
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0060
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 12, 2026

## Description

This update for cyrus-imapd fixes the following issues:  Changes in cyrus-imapd:  - cyrus-imapd don't start because of missing "Requires=var-run.mount" from systemd (bsc#1251788)   Remove var-run.mount from Requires and After  - update to version 3.8.6 (bugfix release)   VUL-0: CVE-2025-49812: cyrus-imapd: Opossum Attack Application Layer   Desynchronization using Opportunistic TLS (bsc#1246165)   The industry is deprecating STARTTLS (aka opportunistic TLS) in favor of   implicit TLS over a dedicated port.  STARTTLS is now disabled by default.   * Fixed issue #5477: master: tighten up pidfile/etc handling (bsc#1241543)     VUL-0: cyrus-imapd: privilege drop happens too late, opening attack vectors from cyrus to root   * Fixed issue #5450: fix zoneinfo_db code for GCC 15 (thanks Yadd)   * Fixed issue #5309: deadlock on shutdown (thanks Mark Cammidge)   * Fixed issue #5424: recognise service-specific SASL options in     ``cyr_info conf-lint``   * Fixed issue #5420: fix double-free in http_admin (thanks Wolfgang Breyha)   * Fixed issue #5460: pop3d: add basic prometheus support (thanks Wolfgang     Breyha)   * Fixed issue #5454: httpd fails to parse OpenSSL version for status string  - update to version 3.8.5 (bugfix release)   * Fixed Issue #5029: check for unexpected extra tiny-tests directories   * Fixed Issue #5148: added --enable-release-checks configure option for use when building releases   * Fixed Issue #4489: calendar-color "changes" namespace (thanks Дилян Палаузов)   * Fixed Issue #5009: various portability warnings and nits   * Fixed Issue #5050: iTIP line endings (thanks Дилян Палаузов)   * Fixed Issue #5052: iMIP line endings (thanks Дилян Палаузов)   * Fixed Issue #5072: http_cgi use after free (thanks Дилян Палаузов)   * Fixed Issue #5094: httpd crash when PROPFIND url is /dav/calendars   * Fixed Issue #5118: broken language checks for "zr-hant" and "sr-me"   * Fixed Issue #5047: proxying UID SEARCH  - CVE-2025-23394: cyrus-imapd: daily-backup.sh allows escalation from cyrus to root (bsc#1241536)

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | cyrus-imapd opensuse-leap 16.0 | 3.8.6-bp160.1.1 | [OPENSUSE-SU-2026:20962-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20962-1.md) | Jun 12, 2026 |

---

Data as of 2026-11-10T07:50:38Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.