CVE-2026-27857: Open-Xchange Dovecot denial of service via NOOP command memory exhaustion

CVE-2026-27857 · Severity: medium · CVSS 4.3 · Published 2026-03-27

Dovecot, a widely used email server for handling IMAP and POP3 protocols, is vulnerable to a denial-of-service attack. An attacker can send specially crafted commands that consume excessive server memory, potentially causing the email service to crash or become unresponsive for all users. This could lead to significant service outages and prevent employees or customers from accessing their email.

Technologies: Dovecot, Open-Xchange Dovecot CE, Open-Xchange Dovecot Pro. Vendors: Dovecot, Open-Xchange.

Quick answers

Is CVE-2026-27857 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-27857 being exploited in the wild.
How severe is CVE-2026-27857?
Medium severity, with a CVSS score of 4.3, published 27 March 2026.
Which products and versions are affected?
Open-Xchange Dovecot CE 2.4.0, 2.4.1, 2.4.3; Open-Xchange Dovecot Pro 2.3.0, 2.3.22.1, 3.0.2, 3.0.5, 3.1.0, 3.1.2, 3.1.3, 3.1.4.
Is there a fix for CVE-2026-27857?
A patch was published on 2026-05-04: Red Hat released security updates (RHSA-2026:13498) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27857 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-27857?
Check whether you run Dovecot, Open-Xchange Dovecot CE or Open-Xchange Dovecot Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A resource exhaustion vulnerability (CWE-400/CWE-770) exists in Dovecot's handling of the NOOP command. By sending a NOOP command containing approximately 4,000 nested parentheses without a terminating line feed (LF), an attacker can force the server to allocate and hold ~1MB of memory per connection. By establishing approximately 1,000 such connections from a single IP, an attacker can reach the process virtual size (VSZ) limit, triggering the OOM killer or process termination, thereby crashing the service and all active proxied connections. The vulnerability is reachable over the network without authentication. Patches are available from Open-Xchange and Red Hat.

Affected products

  • Open-Xchange Dovecot Pro 2.3.0, 2.3.22.1, 3.0.2, 3.0.5, 3.1.0, 3.1.2, 3.1.3, 3.1.4
  • Open-Xchange Dovecot CE 2.4.0, 2.4.1, 2.4.3
  • Red Hat Red Hat Enterprise Linux 8, 10, 10.2

Timeline

  • 2026-03-27: advisory: Initial release of OXDC-ADV-2026-0001
  • 2026-05-04: patched: Red Hat released security updates (RHSA-2026:13498)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.