EUVD-2026-16567
GHSA-j26c-8p6m-gpfj
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
4Tags
Description
Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection. This 1 MB can be left allocated for longer time periods by not sending the command ending LF. So attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the process and its other proxied connections. Attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the process and its other proxied connections. Install fixed version, there is no other remediation. No publicly available exploits are known.
Analysis
OX Dovecot Pro suffers from uncontrolled memory allocation in the NOOP command parser (CWE-400), allowing authenticated remote attackers to exhaust server memory and trigger denial of service. By sending NOOP commands with deeply nested parentheses and withholding the line terminator, an attacker can force ~1 MB allocations per connection that persist indefinitely, enabling a single IP to establish 1000+ concurrent connections and exhaust the virtual memory limit, crashing the process and severing all proxied client connections. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.
Sign in for detailed remediation steps.
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| trusty | not-affected | code not present |
| xenial | not-affected | code not present |
| bionic | not-affected | code not present |
| focal | needed | - |
| jammy | needed | - |
| noble | needed | - |
| questing | needed | - |
| upstream | released | 2.4.3 |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 1:2.3.13+dfsg1-2+deb11u1 | - |
| bullseye (security) | vulnerable | 1:2.3.13+dfsg1-2+deb11u2 | - |
| bookworm, bookworm (security) | vulnerable | 1:2.3.19.1+dfsg1-2.1+deb12u1 | - |
| trixie | vulnerable | 1:2.4.1+dfsg1-6+deb13u3 | - |
| trixie (security) | vulnerable | 1:2.4.1+dfsg1-6+deb13u1 | - |
| forky, sid | vulnerable | 1:2.4.2+dfsg1-4 | - |
| (unstable) | fixed | (unfixed) | - |
Share
External POC / Exploit Code
Leaving vuln.today