IMAP Thread Command Vulnerability in Open-Xchange Mail Server

CVE-2026-40017

What is CVE-2026-40017?

An identified vulnerability allows an attacker to exploit the THREAD command in the Open-Xchange Mail Server. By manipulating message headers to create a collision in an internal hash table, this can lead to excessive CPU consumption whenever the THREAD command is executed on an affected mailbox. While this issue is distinct from other vulnerabilities, such as related CVE-2026-40014, it poses a risk of degradation or denial of service for users. Administrators are advised to monitor for unusual CPU usage, terminate any processes that exhibit compromised behavior, and ensure that any offending messages are removed to mitigate the risk.

References