OX Dovecot CVE-2026-42391

No authentication is required - exploitation occurs entirely in the pre-authentication IMAP phase before any LOGIN or AUTHENTICATE command is issued, consistent with the CVSS vector PR:N. The only prerequisite is network connectivity to the IMAP service (port 143 for plaintext or STARTTLS, port 993 for implicit TLS). The IMAP ID extension must be supported by the server, which is standard in Dovecot builds and not a non-default configuration. Exploitation impact is amplified when the imap-login service runs with a high connections-per-process limit (default Dovecot behavior), since OOM-killing one process drops more legitimate sessions. Limiting factors include: the need to reach the IMAP port (which may be firewalled from the public internet in enterprise deployments), and the fact that impact is restricted to availability of IMAP login - authenticated IMAP sessions already past the login process are not directly affected by termination of the imap-login process.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately characterizes this as a high-severity availability threat. All three exploitability signals align: network-reachable attack surface, low complexity, and no authentication required. EPSS data was not provided; given the absence of public exploits and KEV listing, real-world exploitation probability is likely moderate rather than high at this time. The scope is Unchanged (S:U), meaning the CVSS score does not credit the process-level collateral damage to co-hosted IMAP sessions - defenders should treat the practical availability impact as higher than a pure S:U reading suggests for shared-process configurations. There is no confidentiality or integrity impact, making this a pure availability risk. The vendor's own advisory mentions a performance-impacting workaround (limiting connections per imap-login process), confirming the architectural root of the amplification. No KEV listing and no public exploit code lower immediate urgency, but the PR:N pre-authentication attack surface means any exposed IMAP port is a valid entry point with no credential dependency.

An attacker with network access to the IMAP service on port 143 or 993 connects without credentials and repeatedly sends IMAP ID commands each carrying thousands of parameter key-value pairs before issuing any LOGIN or AUTHENTICATE command. Each such command drives the imap-login process's memory and CPU consumption upward; with sufficient volume or parameter count the OOM killer terminates the process, immediately dropping all legitimate user login sessions that shared it. This can be scripted trivially with a standard IMAP library and repeated across multiple imap-login worker processes to sustain the denial of service. No public exploit code is known at this time.