Skip to main content

OX Dovecot Pro EUVDEUVD-2026-16567

| CVE-2026-27857 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-03-27 OX GHSA-j26c-8p6m-gpfj
Denial Of Service Ox Dovecot Pro Open Xchange Gmbh
7.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Connect to exposed IMAP/POP3 listener
  2. Delivery
    Send NOOP with ~4000 parentheses
  3. Exploit
    Omit terminating LF to pin ~1MB
  4. Execution
    Open ~1000 concurrent connections
  5. Persist
    Allocate ~1GB, exceed VSZ limit
  6. Impact
    Process killed, proxied connections dropped

Vulnerability Assessment

Weakness
CWE
CWE-400
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

No special configuration is required - exploitation works against a reachable OX Dovecot Pro service (≤2.3.0) by an unauthenticated remote attacker (PR:N), so any deployment exposing the IMAP/POP3 command interface to the attacker is vulnerable. The specific prerequisites are: network reachability to the listener and the ability to send a 'NOOP' command line with a large parenthesis count (~4000 pairs ≈ 1 MB each) while withholding the terminating LF to keep memory allocated. Limiting factors: meaningful impact requires sustaining many concurrent connections (on the order of ~1000 to reach ~1 GB and trip the VSZ limit), so very large per-process memory ceilings or upstream per-IP connection limits reduce feasibility; commands longer than the tolerated size cause client disconnection rather than further growth. No authentication and no user interaction are needed.
Impact

Signals are largely consistent and point to a real but bounded (availability-only) risk. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5 High) reflects easy, unauthenticated, network-reachable abuse with high availability impact and no confidentiality or integrity loss - matching the description exactly. EPSS is very low (0.04%, 12th percentile) and CISA's SSVC framework rates exploitation=none, automatable=no, technical impact=partial; the vulnerability is not in CISA KEV and no public PoC is known. The low EPSS is reasonable given there is no exploitation observed and the impact is service disruption only, not compromise. This is a legitimate priority for high-availability mail platforms (a single IP can take down a service and its proxied connections), but it is not a code-execution or data-exposure issue. No data is missing or conflicting: CVSS network vector aligns with the remote, no-auth nature described.
Exploit ScenarioDerived

An attacker, without credentials, opens many TCP connections to the exposed Dovecot Pro IMAP/POP3 service and on each sends a 'NOOP (((...)))' command with ~4000 parenthesis pairs while deliberately omitting the trailing line-feed, so each connection holds ~1 MB indefinitely. Scaling to roughly 1000 connections - feasible from a single IP - pins about 1 GB, hitting the VSZ limit and causing the OS to kill the process and drop all proxied sessions. No public exploit code is known, but the attack requires only a scripted raw-socket client given the network vector and low complexity (AV:N/AC:L).
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jun 30, 2026

Remote memory-exhaustion denial of service in OX Dovecot Pro (versions up to and including 2.3.0) lets an unauthenticated network attacker exhaust process memory by sending NOOP commands containing thousands of nested parentheses. Each such command consumes roughly 1 MB, and by withholding the terminating line-feed the attacker keeps the allocation alive; ~1000 concurrent connections from even a single source IP can pin around 1 GB, breaching the process VSZ limit and killing the service along with its proxied connections. There is no public exploit identified at time of analysis (EPSS 0.04%, percentile 12; CISA SSVC exploitation=none), but the vector is trivial and a vendor patch is available.

Earlier versions of this analysis (2)
v2 Jun 30, 2026 - 04:41 cvss changed CVSS 7.5

Denial-of-service in OX Dovecot Pro (versions through 2.3.0) lets remote unauthenticated attackers exhaust process memory by sending IMAP NOOP commands containing thousands of nested parentheses (e.g. "NOOP (((...)))"), each consuming roughly 1MB. By withholding the terminating LF, an attacker holds these allocations open, and around 1,000 connections from even a single source IP can pile up ~1GB and breach the process VSZ limit, killing Dovecot and all of its other proxied connections. EPSS probability is low (0.04%), there is no public exploit identified, and the issue is not in CISA KEV - but a vendor patch is available and CVSS scores it 7.5 (High) for availability impact.

v1 Mar 27, 2026 - 08:30 CVSS 4.3

OX Dovecot Pro suffers from uncontrolled memory allocation in the NOOP command parser (CWE-400), allowing authenticated remote attackers to exhaust server memory and trigger denial of service. By sending NOOP commands with deeply nested parentheses and withholding the line terminator, an attacker can force ~1 MB allocations per connection that persist indefinitely, enabling a single IP to establish 1000+ concurrent connections and exhaust the virtual memory limit, crashing the process and severing all proxied client connections. No public exploit code is known at time of analysis.

RemediationAI

Install the fixed version supplied by Open-Xchange - the vendor states explicitly that upgrading is the only remediation and that no workaround exists. Patch is available per the vendor advisory (oxdc-adv-2026-0001 at https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json); the exact fixed build should be taken from that CSAF or from your distribution's package update rather than guessed. Distribution users should apply the corresponding errata: Ubuntu USN-8136-1 (https://ubuntu.com/security/notices/USN-8136-1), the relevant Red Hat RHSA (e.g. access.redhat.com/errata/RHSA-2026:19364), or the Debian security update for their release. Until patched, the only compensating controls are operational: place per-IP connection-rate and concurrent-connection limits in front of the IMAP/POP3 listener (e.g. firewall/conntrack or a load-balancer connection cap) to blunt the 1000-connection amplification, and consider raising the process VSZ/ulimit headroom - but note these only raise the bar and do not eliminate the exhaustion, and aggressive per-IP limits risk impacting legitimate clients behind shared NAT.

Affected VersionsENISA

OX Dovecot Pro 0 ≤2.3.0

Affected Packages

euvd ox_dovecot_pro no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Dovecot Pro is Open-Xchange's commercial, hardened build of the Dovecot IMAP/POP3 mail server and proxy, widely used by mail-hosting providers as the back-end and front-end MDA/proxy layer. The flaw is classed as CWE-400 (Uncontrolled Resource Consumption): the command parser allocates memory proportional to the depth/count of parenthesis tokens supplied with a NOOP command (~1 MB for 4000 open+close pairs) without bounding total per-connection or per-process allocation, and that memory is not freed while the command line remains unterminated (no LF received). The affected component is identified by CPE cpe:2.3:a:open-xchange_gmbh:ox_dovecot_pro across all versions through 2.3.0. Because the parser tolerates arbitrarily many connections each holding a partial command, an attacker can multiply the per-connection cost until the kernel/ulimit VSZ ceiling forces the process to be killed.

Know when Ox Dovecot Pro gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Remote, unauthenticated, low-complexity command abuse (AV:N/AC:L/PR:N/UI:N) causing process kill and dropped connections; availability-only (A:H), no confidentiality or integrity impact, unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Ubuntu MEDIUM
SUSE 4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Red Hat 7.5 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jun 30, 2026 - 04:41 vuln.today
v3 - CVSS changed
Analysis Updated
Jun 30, 2026 - 04:41 vuln.today
v2 - CVSS changed
Severity Changed
Jun 30, 2026 - 03:24 NVD
MEDIUM HIGH
CVSS changed
Jun 30, 2026 - 03:24 NVD
4.3 (MEDIUM) 7.5 (HIGH)
Patch released
Mar 31, 2026 - 13:49 nvd
Patch available
CVE Published
Mar 27, 2026 - 08:10 nvd
MEDIUM 4.3

DescriptionNVD

Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection. This 1 MB can be left allocated for longer time periods by not sending the command ending LF. So attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the process and its other proxied connections. Attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the process and its other proxied connections. Install fixed version, there is no other remediation. No publicly available exploits are known.

Executive ViewAI

Why It Matters

OX Dovecot Pro versions through 2.3.0 are vulnerable to a denial-of-service attack that allows unauthenticated remote attackers to crash the mail service by exhausting process memory. An attacker can disable the entire email system with minimal resources-approximately 1,000 concurrent connections-potentially from a single source IP. A vendor patch is available and should be deployed immediately to prevent service outages affecting all users.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 88% exploitable
Prevalence
Medium
commercial Dovecot build used by many mail-hosting providers, not universal
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Ox Dovecot Pro

View all
CVE-2026-27860 MEDIUM POC
5.3 Mar 27

Open-Xchange Dovecot Pro contains an LDAP filter injection vulnerability in its authentication module that allows remote
CVE-2026-42007 CRITICAL
9.1 Aug 28

Use-after-free in the OX Dovecot Pro and Dovecot CE mail-editing code lets an authenticated user who can install a Sieve
CVE-2026-27851 CRITICAL
9.1 May 12

Authentication-layer injection in OX Dovecot Pro (versions up to and including 2.4.3 and 3.1.4) arises from a flaw in th
CVE-2026-24031 HIGH
8.2 Mar 27

Authentication bypass and user enumeration in OX Dovecot Pro (versions up to and including 3.1.0 and the 2.4.x line up t
CVE-2026-42391 HIGH
7.5 Aug 28

Denial of service in OX Dovecot Pro and OX Dovecot CE allows unauthenticated remote attackers to exhaust memory and CPU

CVE-2026-33605 HIGH
7.5 Aug 28

ManageSieve login process in OX Dovecot CE and Pro crashes on receipt of a small malformed pre-authentication command, e
CVE-2026-27852 HIGH
7.5 Aug 28

Memory exhaustion in OX Dovecot Pro and OX Dovecot CE allows any remote sender to deny IMAP service to a targeted user b
CVE-2025-59028 HIGH
7.5 Mar 27

Unauthenticated remote attackers can disrupt authentication on OX Dovecot Pro servers by sending malformed base64 SASL d
CVE-2025-59032 HIGH
7.5 Mar 27

OX Dovecot Pro ManageSieve service crashes when processing AUTHENTICATE commands with SASL initial responses using liter
CVE-2026-27858 HIGH
7.5 Mar 27

OX Dovecot Pro managesieve-login process crashes repeatedly due to memory exhaustion triggered by unauthenticated attack
CVE-2026-40018 HIGH
7.4 Aug 28

SQL injection in Open-Xchange OX Dovecot Pro and OX Dovecot CE enables unauthenticated remote attackers, under high-comp
CVE-2026-73208 HIGH
7.4 Aug 28

OAuth2 token validation in OX Dovecot Pro and OX Dovecot CE contains a logic error that permits authentication bypass wh

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Ubuntu

Priority: Medium
dovecot
Release Status Version
trusty not-affected code not present
xenial not-affected code not present
bionic not-affected code not present
focal needed -
jammy needed -
noble needed -
questing needed -
upstream released 2.4.3

Debian

dovecot
Release Status Fixed Version Urgency
bullseye vulnerable 1:2.3.13+dfsg1-2+deb11u1 -
bullseye (security) vulnerable 1:2.3.13+dfsg1-2+deb11u2 -
bookworm, bookworm (security) vulnerable 1:2.3.19.1+dfsg1-2.1+deb12u1 -
trixie vulnerable 1:2.4.1+dfsg1-6+deb13u3 -
trixie (security) vulnerable 1:2.4.1+dfsg1-6+deb13u1 -
forky, sid vulnerable 1:2.4.2+dfsg1-4 -
(unstable) fixed (unfixed) -

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-27857 ADVISORY https://ubuntu.com/security/notices/USN-8136-1 ADVISORY https://vuldb.com/?id.353845 REF https://access.redhat.com/errata/RHSA-2026:13498 REF https://access.redhat.com/errata/RHSA-2026:13830 REF https://access.redhat.com/errata/RHSA-2026:13857 REF https://access.redhat.com/errata/RHSA-2026:17602 REF https://access.redhat.com/errata/RHSA-2026:17625 REF https://access.redhat.com/errata/RHSA-2026:17626 REF https://access.redhat.com/errata/RHSA-2026:17628 REF https://access.redhat.com/errata/RHSA-2026:17630 REF https://access.redhat.com/errata/RHSA-2026:18053 REF https://access.redhat.com/errata/RHSA-2026:19149 REF https://access.redhat.com/errata/RHSA-2026:19364 REF https://access.redhat.com/errata/RHSA-2026:19453 REF https://access.redhat.com/errata/RHSA-2026:19455 REF https://access.redhat.com/errata/RHSA-2026:26564 REF https://access.redhat.com/security/cve/CVE-2026-27857 REF https://bugzilla.redhat.com/show_bug.cgi?id=2452179 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27857.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy