An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CP

Versions reported by the vendor

Affected version ranges reported by the assigning authority (OX). Independent of NVD's CPE analysis and usually ahead of it.

• Open-Xchange GmbH OX Dovecot CE

  • 2.3.0 and later · before 2.4.5affected · semver

• Open-Xchange GmbH OX Dovecot Pro

  • 2.3.0 and later · before 2.3.22.2affected · semver
  • 3.0.0 and later · before 3.0.7affected · semver
  • 3.1.0 and later · before 3.1.6affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-42007An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing
  36Monitor
• CVE-2026-33605An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating.
  30Monitor
• CVE-2026-27852An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters
  30Monitor

Published before and after this one in the same product

• ← EarlierCVE-2026-40205Aug 28, 2026 · An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is requi
  23Monitor
• ← EarlierCVE-2026-42008Aug 28, 2026 · Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a va
  17Monitor
• Later →CVE-2026-42392Aug 28, 2026 · An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the er
  17Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

Code that parses nested structures sets no depth or size limit. A small input can turn into a disproportionate processing load.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1function expand(node) {2  return node.children.map(expand);3}

1const MAX_DEPTH = 32;2function expand(node, depth = 0) {3  if (depth > MAX_DEPTH) throw new Error("too deep");4  return node.children.map((c) => expand(c, depth + 1));5}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.