OX Dovecot Pro CVE-2026-42006

|

EUVD

EUVD-2026-29473 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-05-12 OX

GHSA-h665-fh45-xq6r

Denial Of Service Ox Dovecot Pro Open Xchange Gmbh

4.3

CVSS 3.1 · Vendor: OX

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Recon

Obtain IMAP credentials
Delivery

Connect to IMAP server
Exploit

Send IMAP command with excessive open braces
Install

IMAP parser allocates memory per brace level
C2

Memory consumption reaches vsz_limit
Execute

IMAP process killed
Impact

Denial of service

Vulnerability Assessment

Weakness	CWE CWE-400 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V2 - Validation and Business Logic Resource consumption limits MITRE ATT&CK 1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The attacker must possess valid IMAP credentials (username and password or equivalent authentication token) for the target OX Dovecot Pro server. The attack is specific to IMAP protocol handling and does not apply to other protocols (POP3, LMTP, etc.) unless they share the same vulnerable parsing code. Exploitation does not require any special server configuration; the vulnerability exists in the default IMAP process behavior. The attack is limited to the scope of a single IMAP process; exploiting multiple processes would require multiple authenticated sessions. The csz_limit configuration parameter controls the upper bound of memory exhaustion-a low vsz_limit mitigates (but does not eliminate) the impact by terminating the malicious session sooner.
Impact	CVSS 4.3 with authenticated network attack vector (AV:N/AC:L/PR:L/UI:N/S:U) indicates moderate severity with low complexity; authentication requirement (PR:L) significantly limits real-world risk compared to unauthenticated DoS. The vulnerability requires valid IMAP credentials, restricting the attack surface to users or compromised accounts with mail access. No active exploitation or public proof-of-concept is reported, and EPSS data is not provided in the input, limiting ability to assess likelihood of real-world abuse. However, as a memory exhaustion DoS against an authenticated protocol, the practical risk depends on credential exposure-in environments with weak password policies, shared mailbox accounts, or credential leakage, this becomes a medium risk. The incomplete prior patch (CVE-2026-27857) suggests the vendor may have underestimated the attack surface, raising concerns about additional bypasses. SSVC framework: exploitation status is not confirmed exploited (no KEV, no POC), impact is availability only (no data confidentiality or integrity), automatable as yes (no user interaction required post-authentication).
Exploit ScenarioDerived	An attacker with valid IMAP credentials (obtained via credential theft, weak passwords, or insider threat) connects to the OX Dovecot Pro IMAP server and sends a crafted command with thousands of unclosed braces, such as 'COMMAND {{{ ... {{{', forcing the parser to allocate memory for each brace level without releasing it. The memory consumption grows rapidly, the IMAP process approaches the vsz_limit, and the process is killed by the kernel, causing denial of service to all users on that IMAP instance.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – May 12, 2026

OX Dovecot Pro allows authenticated attackers to cause uncontrolled memory consumption and denial of service via excessive open braces in IMAP commands, bypassing the incomplete fix from CVE-2026-27857 which only blocked closing braces. An attacker with valid IMAP credentials can exhaust server memory up to the configured vsz_limit, crashing the IMAP process and disrupting mail service.

RemediationAI

Upgrade OX Dovecot Pro to the patched version specified in the vendor advisory https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json. As an interim mitigation pending patching, configure the vsz_limit parameter for the IMAP process to a low value (e.g., 256 MB or lower depending on expected mail size), which will terminate excessively memory-consuming IMAP sessions before they exhaust system RAM. This workaround sacrifices server responsiveness under load and may prematurely kill legitimate large-message operations, so it is suitable only for temporary protection. Additionally, restrict IMAP access via firewall or network segmentation to trusted networks only, reducing the population of authenticated users who can exploit this vulnerability. Monitor IMAP process memory consumption (vsz and rss metrics) for anomalies indicating active exploitation attempts.

Affected VersionsENISA

OX Dovecot Pro 0 ≤3.0.5

OX Dovecot Pro 0 ≤3.1.4

OX Dovecot Pro 0 ≤2.4.3

Affected Packages

euvd ox_dovecot_pro no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

The vulnerability exists in the IMAP protocol handler within OX Dovecot Pro. IMAP uses parentheses and braces for command structure and literal syntax. The original CVE-2026-27857 patched excessive closing braces to prevent unbounded memory allocation, but the fix was incomplete-it failed to account for open braces used in the same attack pattern. The underlying root cause is CWE-400 (Uncontrolled Resource Consumption), where insufficient input validation on IMAP command parsing allows an attacker to trigger memory allocation without proper bounds checking. The IMAP protocol permits nested structures and literals, which are parsed into memory; excessive nesting via open braces forces the parser to allocate memory for each level, consuming RAM until the process hits the configured virtual memory limit (vsz_limit) and is terminated by the kernel.

Know when Ox Dovecot Pro gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (OX) PRIMARY 4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

SUSE MEDIUM

Red Hat 7.5 HIGH

Primary rating from Vendor (OX).

CVSS VectorVendor: OX

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

DescriptionCVE.org

An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit. Using excessive bracing, attacker can cause memory usage up to configured memory limit. Install fixed version, or configure vsz_limit for imap process to low value. No publicly available exploits are known.

Threat Intelligence Overview

EPSS Score

0.0%

Top 98% exploitable

Data Quality

7 sources

Confidence: High

EUVD

CVE.org

EPSS

Vulnrichment Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

No

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

22

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +22

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Ox Dovecot Pro

View all

CVE-2026-27860 MEDIUM This Month POC

Open-Xchange Dovecot Pro contains an LDAP filter injection vulnerability in its authentication module that allows remote

CVE-2026-42007 CRITICAL Act Now

Use-after-free in the OX Dovecot Pro and Dovecot CE mail-editing code lets an authenticated user who can install a Sieve

CVE-2026-27851 CRITICAL Act Now

Authentication-layer injection in OX Dovecot Pro (versions up to and including 2.4.3 and 3.1.4) arises from a flaw in th

CVE-2026-24031 HIGH This Week

Authentication bypass and user enumeration in OX Dovecot Pro (versions up to and including 3.1.0 and the 2.4.x line up t

CVE-2026-42391 HIGH This Week

Denial of service in OX Dovecot Pro and OX Dovecot CE allows unauthenticated remote attackers to exhaust memory and CPU

CVE-2026-33605 HIGH This Week

ManageSieve login process in OX Dovecot CE and Pro crashes on receipt of a small malformed pre-authentication command, e

CVE-2026-27852 HIGH This Week

Memory exhaustion in OX Dovecot Pro and OX Dovecot CE allows any remote sender to deny IMAP service to a targeted user b

CVE-2025-59028 HIGH This Week

Unauthenticated remote attackers can disrupt authentication on OX Dovecot Pro servers by sending malformed base64 SASL d

CVE-2025-59032 HIGH This Week

OX Dovecot Pro ManageSieve service crashes when processing AUTHENTICATE commands with SASL initial responses using liter

CVE-2026-27858 HIGH This Week

OX Dovecot Pro managesieve-login process crashes repeatedly due to memory exhaustion triggered by unauthenticated attack

CVE-2026-27857 HIGH This Week

Remote memory-exhaustion denial of service in OX Dovecot Pro (versions up to and including 2.3.0) lets an unauthenticate

CVE-2026-40018 HIGH This Week

SQL injection in Open-Xchange OX Dovecot Pro and OX Dovecot CE enables unauthenticated remote attackers, under high-comp

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all

CVE-2023-44487 HIGH POC

CVE-2021-21341 HIGH POC

CVE-2022-29885 HIGH POC

CVE-2026-45498 HIGH POC

CVE-2016-8610 HIGH

CVE-2026-28318 HIGH POC

CVE-2023-38180 HIGH

CVE-2025-26673 HIGH

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2011-0611 HIGH POC

CVE-2012-1889 HIGH POC

CVE-2012-0507 CRITICAL POC

CVE-2014-1761 HIGH POC

CVE-2015-5122 CRITICAL POC

CVE-2011-0609 HIGH POC

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7	Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7	Fixed

References

Advisories & patches

ADVISORY https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-42006 ADVISORY https://ubuntu.com/security/notices/USN-8365-1 ADVISORY https://vuldb.com/vuln/363031 REF https://access.redhat.com/errata/RHSA-2026:41905 REF https://access.redhat.com/errata/RHSA-2026:41988 REF https://access.redhat.com/errata/RHSA-2026:42091 REF https://access.redhat.com/errata/RHSA-2026:44355 REF https://access.redhat.com/errata/RHSA-2026:44357 REF https://access.redhat.com/errata/RHSA-2026:44373 REF https://access.redhat.com/errata/RHSA-2026:46379 REF https://access.redhat.com/errata/RHSA-2026:46380 REF https://access.redhat.com/errata/RHSA-2026:46381 REF https://access.redhat.com/errata/RHSA-2026:46532 REF https://access.redhat.com/errata/RHSA-2026:49513 REF https://access.redhat.com/security/cve/CVE-2026-42006 REF https://bugzilla.redhat.com/show_bug.cgi?id=2476476 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42006.json

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy