CVE-2026-42391: IMAP Server DOS Vulnerability

CVE-2026-42391 Overview

CVE-2026-42391 is a resource exhaustion vulnerability in the Dovecot IMAP server disclosed by Open-Xchange. An unauthenticated attacker can send an IMAP ID command with an excessive number of parameters before logging in. The server allocates memory and CPU proportional to the parameter count, causing disproportionate resource consumption. When the operating system out-of-memory handler terminates the imap-login process, all other IMAP connections handled by that process are also terminated. This produces degraded service or full denial of service for IMAP logins. The weakness is classified as uncontrolled resource consumption [CWE-400].

Critical Impact
A single unauthenticated attacker can trigger out-of-memory kills that disconnect all IMAP users sharing the affected imap-login process.

Affected Products

Dovecot IMAP server (Open-Xchange distribution)
Deployments exposing imap-login to untrusted networks
Configurations with multiple connections per imap-login process

Discovery Timeline

2026-08-28 - CVE-2026-42391 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-42391

Vulnerability Analysis

The IMAP ID command, defined in RFC 2971, allows clients and servers to exchange implementation identification fields as key-value pairs. Dovecot accepts the ID command before authentication so clients can advertise their identity during connection setup. The pre-authentication handler does not enforce an upper bound on the number of parameters supplied in a single ID command. Attackers exploit this by sending an ID command containing a very large parameter list, forcing the process to allocate memory and consume CPU cycles that scale with input size.

The imap-login process in Dovecot typically handles many concurrent connections. When the Linux out-of-memory killer terminates the process, every other authenticating user on that worker is disconnected. Attackers do not need credentials, and the attack requires only network reachability to the IMAP service port.

Root Cause

The root cause is missing input size validation in the pre-authentication ID command handler. Dovecot processes and stores each supplied parameter without capping the parameter count or total memory footprint. This falls under [CWE-400] uncontrolled resource consumption. The shared-process architecture amplifies the impact because a single OOM event terminates unrelated user sessions.

Attack Vector

Exploitation occurs over the network against the IMAP or IMAPS listener. An attacker opens a TCP connection to the IMAP service and issues an ID command with an oversized parameter list before authenticating. Repeated or parallel requests accelerate memory pressure until the OOM handler fires. No authentication, user interaction, or special privileges are required. No public proof-of-concept exploit is currently known.

The vulnerability manifests during pre-login command parsing in imap-login. See the Open-Xchange Security Advisory OXDC-ADV-2026-0003 for vendor technical details.

Detection Methods for CVE-2026-42391

Indicators of Compromise

Unexpected termination of imap-login processes with kernel OOM killer entries in dmesg or /var/log/messages.
Spikes in resident memory usage by imap-login correlated with inbound IMAP connections from a small number of source addresses.
Bursts of IMAP ID commands in pre-authentication traffic containing large numbers of key-value pairs.
Sudden mass disconnection events affecting authenticated IMAP sessions on the same worker process.

Detection Strategies

Inspect IMAP protocol traffic for ID commands whose parameter count or total length exceeds normal client behavior (typical clients send fewer than 10 fields).
Correlate imap-login process restarts with source IPs opening connections in the seconds prior to the OOM event.
Alert on repeated pre-authentication command anomalies from the same peer within short time windows.

Monitoring Recommendations

Enable verbose Dovecot logging for pre-authentication commands and forward logs to a centralized analytics platform for correlation.
Monitor host-level metrics for imap-login memory growth, cgroup OOM events, and process restart counts.
Track IMAP login success and failure rates; a drop in successful logins combined with process restarts indicates active exploitation.

How to Mitigate CVE-2026-42391

Immediate Actions Required

Update Dovecot to a non-vulnerable version as directed in Open-Xchange Security Advisory OXDC-ADV-2026-0003.
Restrict IMAP exposure to trusted networks where feasible and place the service behind rate-limiting proxies.
Deploy connection and command rate limits at the network edge to blunt volumetric abuse of the ID command.

Patch Information

Open-Xchange has published a fixed release referenced in advisory OXDC-ADV-2026-0003. Administrators should apply the vendor-supplied update to their Dovecot packages. The advisory is the authoritative source for fixed version numbers and package identifiers.

Workarounds

Lower the number of connections handled by a single imap-login process so that an OOM kill affects fewer users. This carries a performance impact due to increased process count.
Enforce per-source connection limits and pre-authentication command timeouts using firewall or reverse-proxy controls.
Block or rate-limit clients that submit pre-authentication ID commands with abnormally large parameter lists.

bash

# Example: reduce connections per imap-login process in dovecot.conf
service imap-login {
  # Lower client_limit trades throughput for blast-radius reduction
  client_limit = 100
  process_limit = 512
  process_min_avail = 16
}