Denial of Service Vulnerability in SOGo Application by Alinto

CVE-2026-127141

What is CVE-2026-127141?

SOGo versions prior to 5.12.13 are susceptible to a denial of service exploit that allows authenticated users to exhaust the application's worker processes. By configuring an auxiliary IMAP mail account connected to a host that fails to send an IMAP greeting response, attackers can send concurrent GET requests to the mail view. This action can indefinitely occupy all worker processes until they are forcibly terminated and restarted by the system’s watchdog, resulting in service unavailability for legitimate users for a duration of approximately five minutes.

References