CVE-2026-27852: Email Server DOS Vulnerability via Headers

CVE-2026-27852 Overview

CVE-2026-27852 is a denial-of-service vulnerability in Dovecot affecting message parsing over Internet Message Access Protocol (IMAP). An attacker who can send email to a target user can craft a message with headers containing a very large number of email addresses or Multipurpose Internet Mail Extensions (MIME) parameters. When the recipient later reads the message over IMAP, the parser consumes excessive memory and exhausts the process memory limit, terminating the session and denying service to the user. The message is still delivered normally, so the attack persists until the offending message is removed or the server is patched. This weakness is categorized as uncontrolled resource consumption [CWE-400].

Critical Impact
A single crafted email can permanently disrupt a targeted user's IMAP access until the message is deleted or the software is upgraded.

Affected Products

Open-Xchange Dovecot (see vendor advisory for specific versions)
IMAP services parsing message headers with unbounded address or MIME parameter lists
Downstream distributions bundling vulnerable Dovecot builds

Discovery Timeline

2026-08-28 - CVE-2026-27852 published to the National Vulnerability Database (NVD)
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-27852

Vulnerability Analysis

The flaw is a resource-exhaustion condition triggered during header parsing. Dovecot parses message headers when a client fetches a message over IMAP. Structured headers such as To, Cc, Bcc, and MIME Content-Type parameters are expanded into in-memory data structures. When these lists contain an unbounded number of entries, memory allocation grows proportionally.

Because the message is accepted at delivery time and only parsed at read time, the denial of service is deferred. Any subsequent attempt by the user to open or list the message forces the IMAP process to allocate memory beyond its configured limit, causing the process to be terminated. The attack does not require authentication against the target server, only the ability to deliver mail to the victim.

Root Cause

The root cause is missing input bounds on the number of parsed elements per header field. The parser does not cap the count of addresses in address-list headers or the count of parameters in MIME headers before allocating storage for them. Combined with a per-process memory limit that triggers termination on exhaustion, this produces a reliable denial of service.

Attack Vector

Exploitation requires only that the attacker send a single crafted email through any path that reaches the victim's mailbox. No user interaction beyond opening the mailbox is required. The vulnerability affects availability only; confidentiality and integrity are not impacted. Refer to the Open-Xchange Security Advisory for parser-level technical details. No public proof-of-concept code is available at the time of publication.

Detection Methods for CVE-2026-27852

Indicators of Compromise

IMAP or Dovecot process termination events correlated with a specific user fetching a message
Mail store objects containing headers with thousands of address entries or MIME parameters
Repeated out-of-memory (OOM) kills of Dovecot worker processes tied to the same mailbox

Detection Strategies

Inspect inbound Simple Mail Transfer Protocol (SMTP) traffic and mail store contents for messages with abnormally large To, Cc, Bcc, or Content-Type parameter lists.
Alert on Dovecot child process crashes or memory-limit termination log entries in mail.log or syslog.
Correlate IMAP session failures with the specific UID or message being fetched to identify the trigger message.

Monitoring Recommendations

Track memory usage of imap and imap-login processes and alert on sustained spikes near the configured default_vsz_limit.
Log and review SMTP-level rejections and message size or header-count anomalies at the mail transfer agent (MTA).
Enable auditing on mailbox delete operations to identify attempts to remove trigger messages during incident response.

How to Mitigate CVE-2026-27852

Immediate Actions Required

Upgrade Dovecot to the fixed version identified in the Open-Xchange Security Advisory.
Identify and quarantine messages with oversized address or MIME parameter lists in affected mailboxes.
Restart terminated Dovecot processes and restore IMAP service for impacted users.

Patch Information

Open-Xchange has published a security advisory with fixed versions and remediation guidance. Administrators should apply the vendor-supplied update as the primary remediation. Consult the Open-Xchange Security Advisory for the exact version numbers and package details.

Workarounds

At the MTA, enforce limits on header size and reject messages with excessive recipient counts or MIME parameters before delivery.
Increase the Dovecot default_vsz_limit only as a short-term measure; this does not eliminate the underlying condition.
Use administrative tools to locate and delete offending messages from affected mailboxes to restore IMAP access.

bash

# Configuration example: not available - refer to vendor advisory for authoritative guidance