OX Dovecot CVE-2026-73209

Exploitation requires valid IMAP credentials - at minimum a low-privilege mailbox account on the targeted server (PR:L per CVSS vector). The attacker must be able to reach the IMAP service over the network (AV:N, AC:L), and the connection must negotiate or support compressed data transfer, implying the COMPRESS extension or equivalent compression handling is active in the affected code path. No user interaction from another party is required (UI:N). Exploitation is limited by the credential requirement: anonymous or unauthenticated attackers cannot trigger the flaw. The scope is unchanged (S:U), meaning the crash is confined to the IMAP process and does not directly escalate to other system components. There is no confidentiality or integrity impact - the only consequence is availability loss (A:H) via process termination.

The CVSS 3.1 score of 6.5 (Medium) reflects an authenticated, network-exploitable denial-of-service with no confidentiality or integrity impact, which is an accurate characterization. The PR:L metric is the primary risk-reducing factor: an attacker must possess valid IMAP credentials before exploitation is possible, ruling out anonymous or unauthenticated abuse. The AV:N/AC:L combination means any authenticated user - including low-privilege mailbox holders - can trigger the crash remotely without special conditions beyond credentials. No EPSS score was provided in the available data. The vulnerability is not listed in the CISA KEV catalog, and no publicly available exploit code has been identified at the time of analysis. The practical risk is therefore concentrated in multi-tenant email environments where untrusted or potentially compromised accounts exist; a single authenticated user can repeatedly crash the IMAP process, denying service to all users. In single-tenant or tightly controlled deployments, the risk is meaningfully lower.

An attacker holding a valid mailbox account - or credentials obtained through phishing or credential stuffing - connects to the target IMAP server and initiates a session with compression negotiated. The attacker transmits a specially crafted compressed data structure designed to trigger deep or infinite recursion within the decompression handler, exhausting the IMAP process's stack and causing it to crash. If the process is not automatically restarted, all IMAP sessions are terminated and no users can access their mail until the service is manually recovered.