OX Dovecot CVE-2026-52687

Exploitation requires a valid IMAP account on the target server - any low-privilege authenticated user qualifies per the CVSS PR:L metric. Additionally, IMAP compression must be enabled and advertised by the server (the COMPRESS extension must be active); if compression is disabled, the attack vector is eliminated entirely. The attacker must also be able to open multiple simultaneous IMAP connections to the same imap-login process instance, so per-user connection rate limits or strict concurrent connection caps partially reduce impact severity but do not prevent the attack. Exploitation is bounded to availability impact only - there is no path to data exfiltration or session hijacking. Non-IMAP protocols served by OX Dovecot (POP3, LMTP, ManageSieve) are not referenced as affected.

The CVSS 3.1 score of 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately reflects a network-accessible, low-complexity attack requiring only authenticated (low-privilege) access, with high availability impact and no confidentiality or integrity consequence. The PR:L metric is significant: any valid IMAP account - including low-privilege shared-mailbox users - is sufficient to mount the attack, broadening the threat surface in hosted email environments where many untrusted users share infrastructure. EPSS data is not provided in the available intelligence, so exploitation probability cannot be quantified precisely. No KEV listing and no public exploits are known, suggesting this is not currently under active or widespread exploitation. Real-world priority is moderate: the attack is repeatable and low-cost for any authenticated attacker, but impact is limited to availability and affects only the imap-login process instances rather than data confidentiality. Organizations running OX Dovecot in ISP, hosting, or enterprise multi-tenant configurations should treat this as a meaningful operational risk despite the absence of public exploit code.

An attacker with a valid IMAP account connects to the server multiple times, negotiating a memory-intensive compression algorithm (such as DEFLATE with large decompression state requirements) on each connection. After opening only a handful of such concurrent sessions, the imap-login process exhausts its memory ceiling, crashes, and drops all legitimate IMAP sessions it was managing - causing a service outage for other users. No publicly available proof-of-concept code exists at the time of analysis.