CVE-2026-40017: IMAP Server DOS Vulnerability via Thread

CVE-2026-40017 Overview

CVE-2026-40017 is a resource exhaustion vulnerability affecting Dovecot IMAP server implementations distributed by Open-Xchange. An attacker who can send email to a target user can craft message headers whose values deliberately collide in an internal hash table. When any IMAP client subsequently issues a THREAD command against the affected mailbox, the server consumes CPU disproportionate to the message size, causing service degradation or denial of service. The issue is distinct from CVE-2026-40014 and is not remediated by that earlier fix. The vulnerability is classified under [CWE-400: Uncontrolled Resource Consumption].

Critical Impact
Remote attackers can trigger sustained CPU exhaustion on IMAP servers by sending a single crafted email, degrading mail service availability for all users on the affected mailbox host.

Affected Products

Dovecot IMAP server (Open-Xchange distribution) - see Open-Xchange Security Advisory OXDC-ADV-2026-0003
IMAP mailboxes exposing the THREAD command extension
Multi-tenant mail hosting environments running vulnerable Dovecot versions

Discovery Timeline

2026-08-28 - CVE-2026-40017 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-40017

Vulnerability Analysis

The vulnerability resides in the message threading logic invoked by the IMAP THREAD command. Dovecot organizes messages into conversation threads using an internal hash table keyed on header values such as Message-ID, References, and In-Reply-To. When multiple keys hash to the same bucket, lookup and insertion operations degrade from average constant time to linear time. An attacker who controls header values in delivered mail can select values that force worst-case hash collisions. Subsequent THREAD operations then process each message with quadratic cost relative to the mailbox size.

This is an algorithmic complexity attack. The message payload does not need to be large. A small number of crafted messages is sufficient to make THREAD operations consume substantial CPU on every invocation.

Root Cause

The root cause is the use of a hash function without collision-resistant seeding or randomization for attacker-influenced input. Because message header values are ingested from untrusted senders and used directly as hash keys, an attacker who understands the hash function can precompute inputs that map to the same bucket. The previous fix for CVE-2026-40014 addressed a related but separate code path and does not cover the THREAD command handler.

Attack Vector

Exploitation requires only the ability to send mail to a user hosted on the vulnerable server. The attacker composes one or more messages whose Message-ID, References, or related threading headers are chosen to collide in the internal hash table. The attack triggers when the recipient or any IMAP client running against the mailbox issues a THREAD command, which many modern mail clients do automatically when opening a folder. The user interaction requirement reflects the need for a client to invoke THREAD, not any direct victim action against the crafted message. No authentication as the attacker is required beyond the ability to deliver mail.

No publicly available exploits are documented for this issue.

Detection Methods for CVE-2026-40017

Indicators of Compromise

Sustained high CPU utilization by the Dovecot imap worker process tied to a specific mailbox or user session
IMAP client timeouts or slow folder-open operations correlated with THREAD command execution in Dovecot logs
Messages with unusually structured or repetitive Message-ID, References, or In-Reply-To header values delivered to affected mailboxes

Detection Strategies

Enable Dovecot verbose command logging and alert on THREAD commands whose execution time exceeds a baseline threshold
Correlate mail delivery events with CPU spikes on the IMAP server to isolate the triggering message set
Inspect stored .dovecot.index metadata and raw message headers in suspect mailboxes for anomalous header value patterns

Monitoring Recommendations

Baseline per-user IMAP CPU consumption and alert on statistical outliers
Monitor process-level resource usage for Dovecot IMAP worker processes and enforce cgroup or ulimit boundaries
Ingest Dovecot logs and mail transfer agent (MTA) logs into a centralized analytics platform to correlate sender, recipient, and command latency

How to Mitigate CVE-2026-40017

Immediate Actions Required

Identify Dovecot deployments referenced in Open-Xchange Security Advisory OXDC-ADV-2026-0003 and schedule updates to non-vulnerable versions
When an active exhaustion is observed, terminate the offending imap process and remove the crafted message from the affected mailbox
Apply per-process CPU and memory limits to Dovecot IMAP workers to contain impact until patches are deployed

Patch Information

Open-Xchange has issued security advisory OXDC-ADV-2026-0003 covering this issue. Administrators should update Dovecot to the fixed release identified in the advisory. Because CVE-2026-40017 is a separate defect from CVE-2026-40014, systems patched only for the earlier CVE remain vulnerable and require the newer update.

Workarounds

Restrict or disable the IMAP THREAD capability where mail clients do not require server-side threading
Enforce inbound header validation at the MTA to reject or normalize messages with malformed or excessively repetitive threading headers
Apply rate limiting on THREAD command frequency per user session at an IMAP proxy layer
Move at-risk users to isolated Dovecot instances with strict cgroup CPU quotas until patching is complete