CVE-2026-42006 Denial of service in OX Dovecot Pro
An attacker can cause denial of service via excessive IMAP bracing, leading to uncontrolled memory usage in OX Dovecot Pro.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42006?
CVE-2026-42006 is a medium-severity denial of service vulnerability in Dovecot Dovecot, published on 12 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit. Using excessive bracing, attacker can cause memory usage up to configured memory limit. Install fixed version, or configure vsz_limit for imap process to low value. No publicly available exploits are known.
Which versions are affected by CVE-2026-42006?
It affects 2 products.
Linux distribution packages (40)
dovecot AlmaLinux:10 | All versions | 1:2.3.21-19.el10_2.1 |
dovecot-devel AlmaLinux:10 | All versions | 1:2.3.21-19.el10_2.1 |
dovecot-mysql AlmaLinux:10 | All versions | 1:2.3.21-19.el10_2.1 |
dovecot-pgsql AlmaLinux:10 | All versions | 1:2.3.21-19.el10_2.1 |
dovecot-pigeonhole AlmaLinux:10 | All versions | 1:2.3.21-19.el10_2.1 |
dovecot AlmaLinux:8 | All versions | 1:2.3.16-8.el8_10 |
dovecot-devel AlmaLinux:8 | All versions | 1:2.3.16-8.el8_10 |
dovecot-mysql AlmaLinux:8 | All versions | 1:2.3.16-8.el8_10 |
dovecot-pgsql AlmaLinux:8 | All versions | 1:2.3.16-8.el8_10 |
dovecot-pigeonhole AlmaLinux:8 | All versions | 1:2.3.16-8.el8_10 |
dovecot AlmaLinux:9 | All versions | 1:2.3.16-18.el9_8.1 |
dovecot-devel AlmaLinux:9 | All versions | 1:2.3.16-18.el9_8.1 |
dovecot-mysql AlmaLinux:9 | All versions | 1:2.3.16-18.el9_8.1 |
dovecot-pgsql AlmaLinux:9 | All versions | 1:2.3.16-18.el9_8.1 |
dovecot-pigeonhole AlmaLinux:9 | All versions | 1:2.3.16-18.el9_8.1 |
dovecot Red Hat:enterprise_linux:10.2 | All versions | 1:2.3.21-19.el10_2.1 |
dovecot-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 1:2.3.21-19.el10_2.1 |
dovecot-debugsource Red Hat:enterprise_linux:10.2 | All versions | 1:2.3.21-19.el10_2.1 |
dovecot-devel Red Hat:enterprise_linux:10.2 | All versions | 1:2.3.21-19.el10_2.1 |
dovecot-mysql Red Hat:enterprise_linux:10.2 | All versions | 1:2.3.21-19.el10_2.1 |
dovecot-mysql-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 1:2.3.21-19.el10_2.1 |
dovecot-pgsql Red Hat:enterprise_linux:10.2 | All versions | 1:2.3.21-19.el10_2.1 |
dovecot-pgsql-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 1:2.3.21-19.el10_2.1 |
dovecot-pigeonhole Red Hat:enterprise_linux:10.2 | All versions | 1:2.3.21-19.el10_2.1 |
dovecot-pigeonhole-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 1:2.3.21-19.el10_2.1 |
dovecot Red Hat:enterprise_linux:8::appstream | All versions | 1:2.3.16-8.el8_10 |
dovecot-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:2.3.16-8.el8_10 |
dovecot-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 1:2.3.16-8.el8_10 |
dovecot-mysql Red Hat:enterprise_linux:8::appstream | All versions | 1:2.3.16-8.el8_10 |
dovecot-mysql-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:2.3.16-8.el8_10 |
dovecot-pgsql Red Hat:enterprise_linux:8::appstream | All versions | 1:2.3.16-8.el8_10 |
dovecot-pgsql-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:2.3.16-8.el8_10 |
dovecot-pigeonhole Red Hat:enterprise_linux:8::appstream | All versions | 1:2.3.16-8.el8_10 |
dovecot-pigeonhole-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:2.3.16-8.el8_10 |
dovecot Red Hat:enterprise_linux:8::crb | All versions | 1:2.3.16-8.el8_10 |
dovecot-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 1:2.3.16-8.el8_10 |
dovecot-debugsource Red Hat:enterprise_linux:8::crb | All versions | 1:2.3.16-8.el8_10 |
dovecot-devel Red Hat:enterprise_linux:8::crb | All versions | 1:2.3.16-8.el8_10 |
dovecot-mysql-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 1:2.3.16-8.el8_10 |
dovecot-pgsql-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 1:2.3.16-8.el8_10 |
Products include Dovecot Dovecot, Open-Xchange Dovecot.
How do I fix CVE-2026-42006?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-42006 being exploited?
There is no known exploitation of CVE-2026-42006 in the wild and no public exploit code.
Other vulnerabilities in Dovecot Dovecot
Sources
Also known as ALPINE-CVE-2026-42006, ALSA-2026:41905, ALSA-2026:41988, ALSA-2026:46532, AZL-86811, CLSA-2026-1779360036 and 19 more.