In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is related to imapx_free_capability and imapx_connect_to_server.
https://lists.debian.org/debian-lts-announce/2020/08/msg00005.html
https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/189