# CVE-2026-42006: Open-Xchange Dovecot uncontrolled memory consumption in IMAP

Source: https://junglewise.ai/threats/cve-2026-42006-open-xchange-dovecot-uncontrolled-memory-consumption-in-imap  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-42006 · Severity: medium · CVSS 4.3 · Published 2026-05-12

Open-Xchange Dovecot is a widely used email server. A vulnerability in its IMAP handling allows an attacker to send specially crafted commands that consume excessive server memory. This can lead to a denial-of-service condition where the email service becomes slow or unavailable for other users.

Technologies: [Dovecot](https://junglewise.ai/threats/technologies/dovecot), [Open-Xchange Dovecot CE](https://junglewise.ai/threats/technologies/dovecot-ce), [Open-Xchange Dovecot Pro](https://junglewise.ai/threats/technologies/dovecot-pro). Vendors: [Dovecot](https://junglewise.ai/threats/vendors/dovecot), [Open-Xchange](https://junglewise.ai/threats/vendors/open-xchange).

## Quick answers

**Is CVE-2026-42006 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42006 being exploited in the wild.

**How severe is CVE-2026-42006?** Medium severity, with a CVSS score of 4.3, published 12 May 2026.

**Which products and versions are affected?** Open-Xchange Dovecot CE 2.4.0, 2.4.3; Open-Xchange Dovecot Pro 2.3.0, 3.0.5, 3.1.0, 3.1.4.

**Is there a fix for CVE-2026-42006?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42006 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42006?** Check whether you run Dovecot, Open-Xchange Dovecot CE or Open-Xchange Dovecot Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a resource exhaustion issue (CWE-400) in the IMAP component of Dovecot. It stems from an incomplete fix for CVE-2026-27857; while closing braces were previously restricted, an attacker can still use excessive open braces to bypass memory allocation limits. A remote attacker with basic user privileges can send these crafted IMAP commands to consume memory up to the configured process limit, potentially causing a denial of service. The issue is resolved in Dovecot Pro 3.1.5 and Dovecot CE 2.4.4. As a workaround, administrators can configure a low 'vsz_limit' for the IMAP process.

## Affected products

- Open-Xchange Dovecot Pro 2.3.0, 3.0.5, 3.1.0, 3.1.4
- Open-Xchange Dovecot CE 2.4.0, 2.4.3

## Timeline

- 2026-05-12: advisory: Initial public release of the advisory
- 2026-05-12: disclosed: NVD publication date

## References

- [https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json](https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json)

## Related threats

- [Open-Xchange Dovecot stack exhaustion denial of service](https://junglewise.ai/threats/cve-2026-73209-open-xchange-dovecot-stack-exhaustion-denial-of-service)
- [Open-Xchange Dovecot OAuth2 token scope validation bypass](https://junglewise.ai/threats/cve-2026-73208-open-xchange-dovecot-oauth2-token-scope-validation-bypass)
- [Open-Xchange Dovecot denial of service via IMAP compression](https://junglewise.ai/threats/cve-2026-52687-open-xchange-dovecot-denial-of-service-via-imap-compression)
- [Open-Xchange Dovecot Sieve CPU resource accounting bypass](https://junglewise.ai/threats/cve-2026-52681-open-xchange-dovecot-sieve-cpu-resource-accounting-bypass)
- [Open-Xchange Dovecot denial of service via NUL byte in trusted proxy forwarding](https://junglewise.ai/threats/cve-2026-42395-open-xchange-dovecot-denial-of-service-via-nul-byte-in-trusted)