Executive brief
OX Dovecot Pro is an IMAP mail server used to handle email access for users. An unauthenticated attacker can send malformed commands before logging in that trigger excessive memory and CPU consumption, causing the server process to crash and terminating all email access for users connected through that process. This can degrade or completely deny service to email users.
Technical details
The vulnerability is a denial-of-service flaw in OX Dovecot Pro's IMAP ID command handling. An unauthenticated remote attacker can send an IMAP ID command with an excessive number of parameters before authentication, which causes disproportionate memory and CPU consumption. When memory limits are exceeded, the out-of-memory handler terminates the login process, which also kills all other IMAP connections handled by the same process. The attack requires network access to the IMAP port but no authentication. Patches are available in versions 2.3.22.2, 3.0.7, and 3.1.6 and later.
Affected products
- Open-Xchange Dovecot Pro 2.3.0 before 2.3.22.2, 3.0.0 before 3.0.7, 3.1.0 before 3.1.6
Timeline
- 2026-08-28: disclosed: Public disclosure via Open-Xchange security advisory
- 2026-08-28: patched: Fixed in versions 2.3.22.2, 3.0.7, and 3.1.6