Memory Management Flaw in Dovecot by Open-Xchange

CVE-2026-27857

What is CVE-2026-27857?

A vulnerability exists within Dovecot where sending a specific command, namely 'NOOP (((...)))' with an excessively large number of parentheses, leads to substantial memory allocation. This can consume approximately 1MB of memory per command executed. If the command is improperly terminated, the allocated memory can persist over time, allowing an attacker to connect from a single IP and create numerous connections, thus exhausting the system's memory resources. This can potentially result in application crashes and loss of service. Strictly updating to the patched version is crucial, as no alternative remediation options are available, and there are currently no publicly known exploits.

References