Executive brief
OX Dovecot is an email server software that manages user mailboxes and handles message retrieval protocols like IMAP. An attacker can send a crafted email with abnormally large header sections (containing numerous email addresses or MIME parameters) that causes the server to consume excessive memory when the message is parsed, crashing the process and denying service to the affected user.
Technical details
The vulnerability is a denial-of-service flaw triggered by malformed email headers containing an excessively large number of email addresses or MIME parameters. When a user retrieves the message via IMAP, the mail parsing logic fails to enforce reasonable limits on header size or complexity, leading to runaway memory allocation that exceeds process limits and terminates the process. The attack requires only the ability to send mail to a target user (a low privilege operation on most systems) but no authentication or special user interaction beyond normal message reading. Patches are available in versions 2.3.22.2, 3.0.7, and 3.1.6 or later.
Affected products
- Open-Xchange Dovecot 2.3.0 to <2.3.22.2, 3.0.0 to <3.0.7, 3.1.0 to <3.1.6
Timeline
- 2026-08-26: disclosed: Advisory initially released
- 2026-08-28: other: Public release of advisory
- 2026-08-28: patched: Patches available in versions 2.3.22.2, 3.0.7, and 3.1.6