Large Headers Can Cause Resource Exhaustion

CVE-2024-23185

What is CVE-2024-23185?

A vulnerability exists in the Dovecot email server where very large headers can lead to resource exhaustion when messages are parsed. The message-parser typically processes reasonably sized chunks of data, but it builds the 'full_value' buffer from these chunks without any size constraints. This lack of limitation means that excessively large headers can significantly increase memory usage. Although such headers may not typically be a vector for direct denial of service attacks against a user due to incoming mail size limits imposed by Mail Transfer Agents (MTAs), users can inadvertently affect their own services by appending large mails. This issue, present in all versions of Dovecot, prompts the need for implemented restrictions on header sizes at the MTA level to mitigate potential problems.

References