Junglewise Threat Intelligence

CVE-2026-27857: Open-Xchange Dovecot denial of service via NOOP command memory exhaustion

CVE-2026-27857 · Severity: medium · CVSS 4.3 · Published 2026-03-27

Technologies: Open-Xchange Dovecot CE, Red Hat Enterprise Linux, Dovecot, Open-Xchange Dovecot Pro. Vendors: Open-Xchange, Red Hat, Dovecot.

Executive brief

Dovecot, a widely used email server for handling IMAP and POP3 protocols, is vulnerable to a denial-of-service attack. An attacker can send specially crafted commands that consume excessive server memory, potentially causing the email service to crash or become unresponsive for all users. This could lead to significant service outages and prevent employees or customers from accessing their email.

Technical details

A resource exhaustion vulnerability (CWE-400/CWE-770) exists in Dovecot's handling of the NOOP command. By sending a NOOP command containing approximately 4,000 nested parentheses without a terminating line feed (LF), an attacker can force the server to allocate and hold ~1MB of memory per connection. By establishing approximately 1,000 such connections from a single IP, an attacker can reach the process virtual size (VSZ) limit, triggering the OOM killer or process termination, thereby crashing the service and all active proxied connections. The vulnerability is reachable over the network without authentication. Patches are available from Open-Xchange and Red Hat.

Affected products

  • Open-Xchange Dovecot Pro 2.3.0, 2.3.22.1, 3.0.2, 3.0.5, 3.1.0, 3.1.2, 3.1.3, 3.1.4
  • Open-Xchange Dovecot CE 2.4.0, 2.4.1, 2.4.3
  • Red Hat Red Hat Enterprise Linux 8, 10, 10.2

Timeline

  • 2026-03-27: advisory: Initial release of OXDC-ADV-2026-0001
  • 2026-05-04: patched: Red Hat released security updates (RHSA-2026:13498)

References

Related threats