OX Dovecot CVE-2026-40017

The attacker must be able to deliver email to a mailbox hosted on a vulnerable OX Dovecot instance - standard mail delivery capability, requiring no authentication to the IMAP server itself. Exploitation is triggered when a THREAD-capable IMAP mail client issues the THREAD command against the poisoned mailbox; most modern IMAP clients (Thunderbird, Apple Mail, Outlook via IMAP) issue THREAD automatically as part of normal folder synchronization, making the UI:R barrier low in typical deployments. Servers where the IMAP THREAD extension is explicitly disabled, or deployments where no connected clients use THREAD, are not exploitable. This vulnerability is independent of CVE-2026-40014 and is not mitigated by that patch. Exploitation is bounded to availability impact against the affected mailbox and IMAP service; no credential, data, or integrity compromise is possible through this vector.

The CVSS 6.5 medium score is well-calibrated for this vulnerability. The attack is network-delivered with low complexity and no attacker authentication required (AV:N/AC:L/PR:N), but it critically requires a mail client to issue the IMAP THREAD command against the poisoned mailbox (UI:R), which is the primary real-world throttle on impact. In environments where clients routinely use THREAD - standard behavior in most modern IMAP clients - the UI:R barrier is low. Impact is availability-only (A:H), with no confidentiality or integrity exposure. No CISA KEV listing and no public exploits are identified, placing exploitation probability in the low-to-moderate range. The separation from CVE-2026-40014 is a meaningful operational signal: organizations that patched the prior issue should not assume this attack surface is closed. Real-world impact is bounded to IMAP service degradation per affected mailbox rather than mass system compromise, but repeated poisoning across many mailboxes could constitute a sustained multi-user DoS. EPSS data is not available in current input.

An attacker sends one or more emails to a target user with message headers - such as References or In-Reply-To - whose values are carefully chosen to collide in Dovecot's internal hash table. The messages appear ordinary and are delivered without any special privileges. When the victim's IMAP client (or any client connected to that mailbox) subsequently issues a THREAD command - a routine operation performed automatically by most modern clients when displaying a mailbox - Dovecot enters a pathological CPU-intensive state processing the colliding hash entries, degrading or denying IMAP service for that user or the broader server.