Executive brief
Dovecot is an open-source IMAP and POP3 server used by organizations to manage email delivery and access. An attacker who can send mail to a user can craft specially designed message headers that cause hash collisions in Dovecot's internal processing, making the IMAP THREAD command consume excessive CPU resources. This can degrade performance or cause a denial of service, affecting email availability for all users accessing the affected mailbox.
Technical details
The vulnerability is a hash collision attack against Dovecot's IMAP THREAD command implementation. An attacker who can send mail to a user crafts message headers with carefully chosen values designed to collide in an internal hash table used during THREAD command processing. When a mail client issues a THREAD command on a mailbox containing the malicious message, Dovecot performs excessive hash table operations, consuming CPU disproportionate to the message size. This is a separate issue from CVE-2026-40014. The attack requires only the ability to send mail to the target user (unauthenticated network access in most environments) and affects Dovecot versions 2.3.0–2.3.22.1, 3.0.0–3.0.6, and 3.1.0–3.1.5. Patched versions are available.
Affected products
- Open-Xchange Dovecot 2.3.0–2.3.22.1, 3.0.0–3.0.6, 3.1.0–3.1.5
Timeline
- 2026-08-28: disclosed: Public disclosure