Ox Dovecot Pro CVE-2026-27859

The CVSS 3.1 score of 5.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L reflects a low-impact denial of service: remote, unauthenticated, low complexity, but limited to availability impact only. The attack is highly automatable (AC:L) and requires no user interaction (UI:N), making it straightforward to exploit at scale. However, the actual real-world risk is moderated by several factors: (1) no public exploit code exists, reducing opportunistic attack likelihood; (2) this is not listed as actively exploited in CISA KEV; (3) the impact is availability-only (no confidentiality or integrity compromise); (4) MTAs can implement mitigations via parameter limits without patching. For organizations running OX Dovecot Pro in mail-critical environments, this merits prompt patching to prevent sustained DoS attacks, but it does not represent an emergency-class vulnerability. The combination of low CVSS impact, absent active exploitation signals, and available workarounds places this in the medium-priority category suitable for standard patch management cycles.

An attacker crafts a mail message with thousands of RFC 2231 MIME parameters across Content-Disposition or Content-Type headers and delivers it to the target mail server via SMTP. The LMTP delivery daemon parses the message and begins recursive or iterative parameter processing, which due to lack of complexity constraints, consumes 100% CPU on the affected mail server. If the attacker sends multiple such messages in succession, the mail delivery pipeline becomes starved, legitimate mail delivery stalls, and the mail service experiences functional denial. The attack requires minimal sophistication (a simple mail client or script) and no prior authentication.