# CVE-2026-42391: OX Dovecot Pro denial of service via malformed IMAP ID command

Source: https://junglewise.ai/threats/cve-2026-42391-ox-dovecot-pro-denial-of-service-via-malformed-imap-id-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-42391 · Severity: high · CVSS 7.5 · Published 2026-08-28

OX Dovecot Pro is an IMAP mail server used to handle email access for users. An unauthenticated attacker can send malformed commands before logging in that trigger excessive memory and CPU consumption, causing the server process to crash and terminating all email access for users connected through that process. This can degrade or completely deny service to email users.

Technologies: [Open-Xchange Dovecot Pro](https://junglewise.ai/threats/technologies/dovecot-pro). Vendors: [Open-Xchange](https://junglewise.ai/threats/vendors/open-xchange).

## Quick answers

**Is CVE-2026-42391 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42391 being exploited in the wild.

**How severe is CVE-2026-42391?** High severity, with a CVSS score of 7.5, published 28 August 2026.

**Which products and versions are affected?** Open-Xchange Dovecot Pro 2.3.0 before 2.3.22.2, 3.0.0 before 3.0.7, 3.1.0 before 3.1.6.

**Is there a fix for CVE-2026-42391?** A patch was published on 2026-08-28: Fixed in versions 2.3.22.2, 3.0.7, and 3.1.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42391 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-42391?** Check whether you run Open-Xchange Dovecot Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a denial-of-service flaw in OX Dovecot Pro's IMAP ID command handling. An unauthenticated remote attacker can send an IMAP ID command with an excessive number of parameters before authentication, which causes disproportionate memory and CPU consumption. When memory limits are exceeded, the out-of-memory handler terminates the login process, which also kills all other IMAP connections handled by the same process. The attack requires network access to the IMAP port but no authentication. Patches are available in versions 2.3.22.2, 3.0.7, and 3.1.6 and later.

## Affected products

- Open-Xchange Dovecot Pro 2.3.0 before 2.3.22.2, 3.0.0 before 3.0.7, 3.1.0 before 3.1.6

## Timeline

- 2026-08-28: disclosed: Public disclosure via Open-Xchange security advisory
- 2026-08-28: patched: Fixed in versions 2.3.22.2, 3.0.7, and 3.1.6

## References

- [https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json](https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json)

## Related threats

- [Open-Xchange Dovecot stack exhaustion denial of service](https://junglewise.ai/threats/cve-2026-73209-open-xchange-dovecot-stack-exhaustion-denial-of-service)
- [Open-Xchange Dovecot OAuth2 token scope validation bypass](https://junglewise.ai/threats/cve-2026-73208-open-xchange-dovecot-oauth2-token-scope-validation-bypass)
- [Open-Xchange Dovecot denial of service via IMAP compression](https://junglewise.ai/threats/cve-2026-52687-open-xchange-dovecot-denial-of-service-via-imap-compression)
- [Open-Xchange Dovecot Sieve CPU resource accounting bypass](https://junglewise.ai/threats/cve-2026-52681-open-xchange-dovecot-sieve-cpu-resource-accounting-bypass)
- [Open-Xchange Dovecot denial of service via NUL byte in trusted proxy forwarding](https://junglewise.ai/threats/cve-2026-42395-open-xchange-dovecot-denial-of-service-via-nul-byte-in-trusted)