OX Dovecot EUVD-2026-67664

The attacker must be able to deliver email to the target user's mailbox - no authentication to the Dovecot server itself is required (PR:N per CVSS). The denial-of-service only triggers when a connected IMAP client issues a THREAD command against the mailbox containing the crafted message; this is a routine client operation but is not instantaneous upon message arrival, introducing a temporal gap between delivery and impact. Exploitation is limited by the need for this user-side IMAP THREAD invocation (UI:R per CVSS) and is bounded to availability impact only - there is no pathway to credential theft or data access. The attack does not require any non-default server configuration; any Dovecot deployment with the THREAD IMAP extension enabled (the default) is susceptible.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) accurately reflects the attack profile: network-accessible, low complexity, no authentication, but requiring user interaction in the form of a mail client issuing a THREAD command. The UI:R component is the primary limiting factor - the denial-of-service only materializes when the victim's client actively polls thread data, which is a routine operation for many modern IMAP clients. No EPSS data was provided in the source intelligence, and the CVE is absent from CISA KEV, indicating no confirmed active exploitation at time of analysis. No public proof-of-concept code is known. Despite the moderate CVSS score, the practical barrier to staging the triggering condition is low: an attacker need only send an email, and the THREAD command is often issued automatically by clients during synchronization. Even a mid-sized organization operating shared IMAP infrastructure - the kind that might serve hundreds of mailboxes - should treat this as a meaningful availability risk, particularly in multi-tenant environments where a single crafted message could affect a shared Dovecot process serving many users. The impact is confined to availability with no confidentiality or integrity consequence.

An attacker sends a single email to a targeted user containing a specially crafted message header designed to trigger quadratic or otherwise unbounded CPU work in Dovecot's THREAD parser. When the recipient's mail client - performing routine IMAP synchronization or folder polling - issues a THREAD command against the mailbox, the Dovecot process begins consuming excessive CPU time processing that message. With no public exploit code known, the crafting of such a header requires some reverse-engineering effort, but the delivery mechanism is entirely standard SMTP.