Memory Consumption Vulnerability in Dovecot by Open-Xchange

CVE-2026-42006

What is CVE-2026-42006?

An uncontrolled memory consumption vulnerability exists within Dovecot due to excessive bracing in IMAP operations. Although a previous fix attempted to address this issue by closing braces, it was insufficient as it only mitigated one method of exploitation. An attacker can exploit open braces to bypass the limit and force memory usage to reach the configured memory threshold. To mitigate this vulnerability, users should upgrade to the fixed version or adjust the vsz_limit for the IMAP process to a lower value. At present, there are no known publicly available exploits for this vulnerability.

References