Executive brief
Open-Xchange Dovecot is a widely-used email server component that handles incoming email via the IMAP protocol. An authenticated attacker can trigger a denial-of-service condition by selecting a memory-intensive compression algorithm and opening multiple IMAP connections, exhausting the server's memory and crashing the imap-login process. This disrupts email access for all users relying on that process.
Technical details
This vulnerability is a resource exhaustion flaw in Dovecot's IMAP compression handling. An attacker with valid email credentials can specify a compression algorithm for an IMAP connection whose decompression state consumes substantial memory. By opening several such connections in parallel, the process-level memory limit is rapidly exhausted, causing the imap-login process to terminate and resulting in denial of service for all connections handled by that process. The attack requires valid authentication credentials and is triggered during normal IMAP session negotiation. Patches are available in versions 2.3.22.2, 3.0.7, and 3.1.6 or later; workarounds include disabling IMAP compression or limiting connections per imap-login process.
Affected products
- Open-Xchange Dovecot Pro 2.3.0 to <2.3.22.2, 3.0.0 to <3.0.7, 3.1.0 to <3.1.6
Timeline
- 2026-08-28: disclosed
- 2026-08-28: patched