CVE-2026-42006: IMAP DoS Vulnerability via Excessive Braces

CVE-2026-42006 Overview

CVE-2026-42006 is a resource exhaustion vulnerability in Dovecot's IMAP server, disclosed by Open-Xchange. An authenticated attacker can send IMAP commands containing excessive open braces to trigger uncontrolled memory consumption in the imap process. Memory usage grows until it reaches the configured limit, degrading service availability.

The issue is a bypass of the prior fix shipped for CVE-2026-27857. That earlier patch restricted closing braces but left open braces unbounded. The flaw is categorized as Uncontrolled Resource Consumption [CWE-400].

Critical Impact
Authenticated IMAP users can exhaust memory in the imap process, causing localized denial of service against affected Dovecot instances.

Affected Products

Dovecot IMAP server (Open-Xchange distribution)
Versions with the incomplete fix for CVE-2026-27857
Deployments without a low vsz_limit configured for the imap process

Discovery Timeline

2026-05-12 - CVE-2026-42006 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-42006

Vulnerability Analysis

The vulnerability resides in Dovecot's IMAP command parser. IMAP allows literal and grouped syntax delimited by braces, and the parser allocates internal structures as braces are processed. The earlier fix for CVE-2026-27857 added a guard against excessive closing braces but did not symmetrically restrict open braces.

An authenticated attacker can submit a single crafted IMAP command containing a large sequence of open braces. The parser accepts the input and continues allocating memory for each nested element. Allocation continues until the process reaches its configured memory ceiling.

The attacker requires valid IMAP credentials, and the impact is limited to availability. Confidentiality and integrity are not affected. No publicly available exploits are known at the time of disclosure.

Root Cause

The root cause is incomplete input validation in the brace-handling logic of the IMAP parser. The remediation for CVE-2026-27857 enforced a limit on one direction of brace tokens only. Open braces remained unbounded, leaving the underlying resource-consumption path reachable through a different token sequence.

Attack Vector

Exploitation occurs over the network against the IMAP service. The attacker authenticates with valid credentials, then issues an IMAP command containing an excessive number of open braces. The imap worker process consumes memory proportional to the crafted input until it reaches the system or configured limit and is terminated or stalls.

The vulnerability requires authenticated access but no user interaction. Exploitation is mechanically straightforward and does not require specialized tooling beyond an IMAP client capable of sending raw commands. See the Open-Xchange Security Advisory for technical details.

Detection Methods for CVE-2026-42006

Indicators of Compromise

IMAP sessions sending commands with anomalously large counts of { characters in a single command line.
Repeated imap process restarts or out-of-memory terminations recorded in system logs.
Sudden growth in resident memory of imap worker processes correlated with specific authenticated sessions.

Detection Strategies

Inspect IMAP protocol logs for commands exceeding normal length or containing high ratios of brace characters.
Alert on imap process memory usage approaching the configured vsz_limit.
Correlate authentication events with subsequent abnormal memory consumption per user session.

Monitoring Recommendations

Enable verbose IMAP command logging for auditing client behavior on Dovecot.
Forward imap process resource metrics and OOM-kill events to a centralized logging or SIEM platform.
Track per-user IMAP session resource usage to identify accounts producing outlier memory consumption.

How to Mitigate CVE-2026-42006

Immediate Actions Required

Install the fixed Dovecot version as published in the Open-Xchange Security Advisory.
Configure a low vsz_limit for the imap process to cap per-process memory until patching is complete.
Audit IMAP user accounts and disable or rotate credentials for any accounts not actively in use.

Patch Information

Open-Xchange has released a fixed Dovecot version that closes the open-brace bypass left by the CVE-2026-27857 remediation. Administrators should upgrade to the patched release. The advisory available at the Open-Xchange Security Advisory lists the specific fixed versions.

Workarounds

Set a conservative vsz_limit value in dovecot.conf for the imap service to constrain memory per session.
Apply rate limiting and per-user connection limits at the IMAP layer to reduce abuse potential.
Restrict IMAP access to trusted networks where feasible until the patch is applied.

bash

# Configuration example: cap imap process memory in dovecot.conf
service imap {
  vsz_limit = 256M
  process_limit = 1024
}

# Reload Dovecot after editing the configuration
doveadm reload