CVE-2026-33607: IMAP Service Denial of Service Vulnerability

CVE-2026-33607 Overview

CVE-2026-33607 is a resource consumption vulnerability affecting Dovecot IMAP servers distributed by Open-Xchange. An authenticated attacker can issue crafted IMAP LIST commands that force the server to consume excessive CPU cycles. Sustained abuse degrades service quality and can produce a denial-of-service condition for legitimate IMAP users sharing the same host.

The flaw is categorized as uncontrolled resource consumption [CWE-400]. Exploitation requires valid account credentials but no user interaction. No public exploits are known at the time of publication.

Critical Impact
Authenticated attackers can degrade or deny IMAP service by triggering CPU exhaustion through the LIST command, affecting mail delivery and client connectivity for all tenants on the affected instance.

Affected Products

Open-Xchange Dovecot (see vendor advisory OXDC-ADV-2026-0003 for affected version ranges)
IMAP services provisioned on top of vulnerable Dovecot builds
Multi-tenant mail platforms depending on shared Dovecot workers

Discovery Timeline

2026-08-28 - CVE-2026-33607 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-33607

Vulnerability Analysis

The vulnerability resides in Dovecot's handling of the IMAP LIST command. LIST is used by clients to enumerate mailboxes matching a reference name and wildcard pattern. When an authenticated user issues certain LIST arguments, the server performs work disproportionate to the request size.

Because IMAP LIST responses can involve pattern matching across mailbox hierarchies, an attacker can craft inputs that force expensive enumeration or matching operations. Repeated issuance of these commands pins CPU resources on the mail process. The result is service degradation and, at sufficient volume, denial of service for other IMAP users on the host.

Root Cause

The root cause is uncontrolled resource consumption in the IMAP LIST command handler [CWE-400]. Dovecot processes the command without enforcing bounds that prevent an authenticated client from driving CPU utilization to saturation. The vendor advisory OXDC-ADV-2026-0003 details the affected code path and remediation.

Attack Vector

The attack vector is network-based and requires valid IMAP credentials. An attacker authenticates to the IMAP service and issues one or more LIST commands whose arguments trigger the expensive processing path. No privilege escalation or user interaction is needed. Compromised or low-privilege mailbox accounts are sufficient to abuse the flaw against the hosting infrastructure.

See the Open-Xchange Security Advisory OXDC-ADV-2026-0003 for technical details.

Detection Methods for CVE-2026-33607

Indicators of Compromise

Sustained high CPU usage by Dovecot imap worker processes tied to a single authenticated session
Elevated volume of LIST commands from a single account or source IP in Dovecot logs
IMAP client timeouts and connection failures during peak abuse windows
Authentication logs showing a low-reputation or newly created account issuing repetitive LIST traffic

Detection Strategies

Enable per-command IMAP logging in Dovecot and alert on LIST command rates that exceed baseline per user
Correlate process-level CPU metrics with the IMAP session identifier to attribute usage to a specific account
Monitor mail-server telemetry for imbalance between authentication volume and command volume from the same source

Monitoring Recommendations

Baseline normal imap-login and imap process CPU consumption and alert on sustained deviation
Forward Dovecot logs and host metrics to a central analytics platform for correlation across tenants
Track authenticated session duration and command counts to identify accounts abusing IMAP verbs

How to Mitigate CVE-2026-33607

Immediate Actions Required

Identify Dovecot instances that expose IMAP to authenticated users and confirm version against OXDC-ADV-2026-0003
Monitor Dovecot processes for abnormal CPU consumption and terminate offending sessions
Lock or disable accounts observed issuing abusive LIST traffic pending investigation
Plan and schedule an upgrade to the fixed Dovecot release supplied by Open-Xchange

Patch Information

Open-Xchange has published fixed Dovecot builds. Refer to Open-Xchange Security Advisory OXDC-ADV-2026-0003 for supported versions and upgrade instructions. Apply the fixed version to eliminate the underlying resource consumption defect.

Workarounds

Apply IMAP rate limits on LIST commands per authenticated session at the proxy or load balancer
Enforce per-user process and CPU quotas using cgroups or Dovecot service limits to contain abusive sessions
Restrict IMAP access to trusted networks or require VPN authentication for administrative accounts
Automate detection of high-CPU IMAP workers to kill sessions and lock accounts until patching completes

bash

# Example Dovecot service limits to constrain IMAP worker resources
service imap {
  process_limit = 1024
  vsz_limit = 256M
}

protocol imap {
  mail_max_userip_connections = 10
}