CVE-2026-42391 Denial of service in OX Dovecot CE
Unauthenticated attackers can cause denial of service in Dovecot IMAP logins by sending excessive parameters in the ID command, exhausting resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42391?
CVE-2026-42391 is a high-severity denial of service vulnerability in Open-Xchange GmbH OX Dovecot CE, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by the same process. This can cause degradation or denial of service for IMAP logins. Limit the number of connections handled by a single imap-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known.
Weakness: CWE-400
Which versions are affected by CVE-2026-42391?
How do I fix CVE-2026-42391?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-42391 being exploited?
There is no known exploitation of CVE-2026-42391 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-42391, AZL-98262, DEBIAN-CVE-2026-42391, GHSA-7597-pg24-8mv9, UBUNTU-CVE-2026-42391.