CVE-2024-23185 Denial of service in OX Dovecot Pro
Attackers can cause resource exhaustion via large headers, though MTA limits usually prevent remote DoS; self-DoS via APPEND is possible.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-23185?
CVE-2024-23185 is a high-severity denial of service vulnerability in Open-Xchange GmbH OX Dovecot Pro, published on 10 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the message. However, when it feeds them to message-header-parser, it starts building up "full_value" buffer out of the smaller chunks. The full_value buffer has no size limit, so large headers can cause large memory usage. It doesn't matter whether it's a single long header line, or a single header split into multiple lines. This bug exists in all Dovecot versions. Incoming mails typically have some size limits set by MTA, so even largest possible header size may still fit into Dovecot's vsz_limit. So attackers probably can't DoS a victim user this way. A user could APPEND larger mails though, allowing them to DoS themselves (although maybe cause some memory issues for the backend in general). One can implement restrictions on headers on MTA component preceding Dovecot. No publicly available exploits are known.
Weakness: CWE-770
Which versions are affected by CVE-2024-23185?
How do I fix CVE-2024-23185?
Change a configuration setting.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-23185 being exploited?
There is no known exploitation of CVE-2024-23185 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2024-23185, AZL-48984, AZL-49027, CLSA-2025-1753987188, DEBIAN-CVE-2024-23185, GHSA-g9m4-c8qf-67qw and 1 more.