Log in Start free

Vulnerability · Published May 12, 2026 · Assigned by OX

CVE-2026-42006

Medium 4.3

In plain English

A medium-severity uncontrolled resource consumption in OX Dovecot Pro from Open-Xchange GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.6%top 50.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit. Using excessive bracing, attacker can cause memory usage up to configured memory limit. Install fixed version, or configure vsz_limit for imap process to low value. No publicly available exploits are known.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10dovecot1:2.3.21-19.el10_2.1ALSA-2026:41988
AlmaLinux:8dovecot1:2.3.16-8.el8_10ALSA-2026:46532
AlmaLinux:9dovecot1:2.3.16-18.el9_8.1ALSA-2026:41905
AlmaLinux:10dovecot-devel1:2.3.21-19.el10_2.1ALSA-2026:41988
AlmaLinux:8dovecot-devel1:2.3.16-8.el8_10ALSA-2026:46532
AlmaLinux:9dovecot-devel1:2.3.16-18.el9_8.1ALSA-2026:41905
AlmaLinux:10dovecot-mysql1:2.3.21-19.el10_2.1ALSA-2026:41988
AlmaLinux:8dovecot-mysql1:2.3.16-8.el8_10ALSA-2026:46532
AlmaLinux:9dovecot-mysql1:2.3.16-18.el9_8.1ALSA-2026:41905
AlmaLinux:10dovecot-pgsql1:2.3.21-19.el10_2.1ALSA-2026:41988
AlmaLinux:8dovecot-pgsql1:2.3.16-8.el8_10ALSA-2026:46532
AlmaLinux:9dovecot-pgsql1:2.3.16-18.el9_8.1ALSA-2026:41905
AlmaLinux:10dovecot-pigeonhole1:2.3.21-19.el10_2.1ALSA-2026:41988
AlmaLinux:8dovecot-pigeonhole1:2.3.16-8.el8_10ALSA-2026:46532
AlmaLinux:9dovecot-pigeonhole1:2.3.16-18.el9_8.1ALSA-2026:41905
Alpine:v3.23dovecot2.4.4-r0ALPINE-CVE-2026-42006
Alpine:v3.24dovecot2.4.4-r0ALPINE-CVE-2026-42006
Debian:12dovecot1:2.3.19.1+dfsg1-2.1+deb12u6DEBIAN-CVE-2026-42006
Debian:13dovecot1:2.4.1+dfsg1-6+deb13u6DEBIAN-CVE-2026-42006
Debian:14dovecot1:2.4.4+dfsg1-1DEBIAN-CVE-2026-42006
Rocky Linux:10dovecot1:2.3.21-19.el10_2.1RLSA-2026:41988
Rocky Linux:8dovecot1:2.3.16-8.el8_10RLSA-2026:46532
Rocky Linux:9dovecot1:2.3.16-18.el9_8.1RLSA-2026:41905
Ubuntu:22.04:LTSdovecot1:2.3.16+dfsg1-3ubuntu2.9UBUNTU-CVE-2026-42006
Ubuntu:24.04:LTSdovecot1:2.3.21+dfsg1-2ubuntu6.5UBUNTU-CVE-2026-42006
Ubuntu:25.10dovecot1:2.4.1+dfsg1-5ubuntu4.2UBUNTU-CVE-2026-42006
Ubuntu:26.04:LTSdovecot1:2.4.2+dfsg1-3ubuntu2.1UBUNTU-CVE-2026-42006

Affected products (as reported)

VendorProductVersions
Open-Xchange GmbH OX Dovecot Pro 0 – through 3.0.50 – through 3.1.40 – through 2.4.3

Weakness: CWE-400, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References