Vulnerability · Published Aug 28, 2026 · Assigned by OX
CVE-2026-42391
High 7.5
In plain English
A high-severity uncontrolled resource consumption in OX Dovecot CE from Open-Xchange GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by the same process. This can cause degradation or denial of service for IMAP logins. Limit the number of connections handled by a single imap-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | dovecot | 1:2.3.21-19.el10_2.8 | ALSA-2026:79371 |
| AlmaLinux:8 | dovecot | 1:2.3.16-16.el8_10 | ALSA-2026:76763 |
| AlmaLinux:9 | dovecot | 1:2.3.16-18.el9_8.8 | ALSA-2026:80825 |
| AlmaLinux:10 | dovecot-devel | 1:2.3.21-19.el10_2.8 | ALSA-2026:79371 |
| AlmaLinux:8 | dovecot-devel | 1:2.3.16-16.el8_10 | ALSA-2026:76763 |
| AlmaLinux:9 | dovecot-devel | 1:2.3.16-18.el9_8.8 | ALSA-2026:80825 |
| AlmaLinux:10 | dovecot-mysql | 1:2.3.21-19.el10_2.8 | ALSA-2026:79371 |
| AlmaLinux:8 | dovecot-mysql | 1:2.3.16-16.el8_10 | ALSA-2026:76763 |
| AlmaLinux:9 | dovecot-mysql | 1:2.3.16-18.el9_8.8 | ALSA-2026:80825 |
| AlmaLinux:10 | dovecot-pgsql | 1:2.3.21-19.el10_2.8 | ALSA-2026:79371 |
| AlmaLinux:8 | dovecot-pgsql | 1:2.3.16-16.el8_10 | ALSA-2026:76763 |
| AlmaLinux:9 | dovecot-pgsql | 1:2.3.16-18.el9_8.8 | ALSA-2026:80825 |
| AlmaLinux:10 | dovecot-pigeonhole | 1:2.3.21-19.el10_2.8 | ALSA-2026:79371 |
| AlmaLinux:8 | dovecot-pigeonhole | 1:2.3.16-16.el8_10 | ALSA-2026:76763 |
| AlmaLinux:9 | dovecot-pigeonhole | 1:2.3.16-18.el9_8.8 | ALSA-2026:80825 |
| Alpine:v3.23 | dovecot | 2.4.5-r0 | ALPINE-CVE-2026-42391 |
| Alpine:v3.24 | dovecot | 2.4.5-r0 | ALPINE-CVE-2026-42391 |
| Debian:12 | dovecot | 1:2.3.19.1+dfsg1-2.1+deb12u7 | DEBIAN-CVE-2026-42391 |
| Debian:13 | dovecot | 1:2.4.1+dfsg1-6+deb13u7 | DEBIAN-CVE-2026-42391 |
| Debian:14 | dovecot | 1:2.4.5+dfsg1-1 | DEBIAN-CVE-2026-42391 |
| Rocky Linux:10 | dovecot | 1:2.3.21-19.el10_2.8 | RLSA-2026:79371 |
| Rocky Linux:8 | dovecot | 1:2.3.16-16.el8_10 | RLSA-2026:76763 |
| Rocky Linux:9 | dovecot | 1:2.3.16-18.el9_8.8 | RLSA-2026:80825 |
| Ubuntu:22.04:LTS | dovecot | no fix listed | UBUNTU-CVE-2026-42391 |
| Ubuntu:24.04:LTS | dovecot | no fix listed | UBUNTU-CVE-2026-42391 |
| Ubuntu:26.04:LTS | dovecot | no fix listed | UBUNTU-CVE-2026-42391 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Open-Xchange GmbH | OX Dovecot Pro | 2.3.0 – before 2.3.22.23.0.0 – before 3.0.73.1.0 – before 3.1.6 |
| Open-Xchange GmbH | OX Dovecot CE | 2.3.0 – before 2.4.5 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H