CVE-2026-52687: IMAP Compression Memory Exhaustion DoS Vulnerability

CVE-2026-52687 Overview

CVE-2026-52687 is a resource exhaustion vulnerability in Dovecot IMAP that allows an authenticated attacker to cause denial of service. An attacker with valid credentials can select a compression algorithm whose decompression state consumes a large amount of memory. Opening several such connections exhausts the memory limit of the imap-login process. When the limit is reached, the process terminates along with all connections it handles, degrading or denying IMAP service to legitimate users. The flaw is tracked under CWE-400: Uncontrolled Resource Consumption and was disclosed in the Open-Xchange Security Advisory OXDC-ADV-2026-0003.

Critical Impact
Authenticated attackers can terminate the imap-login process with only a few compressed connections, disrupting IMAP mail service for all users handled by that process.

Affected Products

Open-Xchange Dovecot IMAP server (versions prior to the patched release identified in OXDC-ADV-2026-0003)
Deployments with IMAP COMPRESS extension enabled
Multi-tenant mail platforms sharing imap-login processes across users

Discovery Timeline

2026-08-28 - CVE-2026-52687 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-52687

Vulnerability Analysis

The vulnerability resides in how Dovecot's IMAP service handles compression negotiated via the IMAP COMPRESS extension. IMAP compression allows clients to reduce bandwidth by wrapping the session in a streaming compression algorithm. Each active compressed connection maintains a decompression state in memory. Certain compression algorithms require substantially larger decompression state buffers than others.

An authenticated attacker can select the algorithm with the largest decompression footprint and open multiple such connections in parallel. Because imap-login processes handle many connections concurrently under a shared memory ceiling, only a small number of hostile connections are needed to exceed the per-process limit. The kernel or process supervisor then terminates the process, tearing down every legitimate connection multiplexed on it.

Root Cause

The root cause is the absence of per-connection and per-process caps on memory allocated to decompression state. Dovecot honors the client's algorithm choice without proportionally accounting for the resulting memory cost. This is a classic resource-consumption weakness where an untrusted input (the compression algorithm selection) drives an unbounded server-side allocation.

Attack Vector

Exploitation requires valid IMAP credentials but no user interaction. The attacker authenticates over the network, issues the COMPRESS command selecting the high-memory algorithm, and repeats the process across several parallel sessions. Once the aggregate decompression state exceeds the process memory limit, imap-login terminates. No publicly available exploit code is known at the time of publication.

See the Open-Xchange Security Advisory OXDC-ADV-2026-0003 for vendor-specific technical details.

Detection Methods for CVE-2026-52687

Indicators of Compromise

Repeated imap-login process terminations logged by systemd, the service supervisor, or the kernel OOM killer
Multiple IMAP COMPRESS commands issued from the same authenticated account within a short window
Sudden mass disconnection events affecting unrelated IMAP users sharing a login process
Sustained memory pressure on mail servers correlated with authenticated IMAP sessions from a single source IP

Detection Strategies

Parse Dovecot logs for Fatal and Killed messages associated with imap-login and correlate with preceding COMPRESS activity
Alert on process restart rates for imap-login exceeding an established baseline
Track authenticated sessions that issue COMPRESS followed by long-lived idle connections from the same account

Monitoring Recommendations

Instrument mail servers to emit per-process memory metrics and connection counts for imap-login
Forward Dovecot and system journal logs to a centralized analytics platform for cross-host correlation
Enable authentication-source monitoring to identify accounts opening abnormal numbers of concurrent IMAP sessions

How to Mitigate CVE-2026-52687

Immediate Actions Required

Upgrade Dovecot to the fixed version referenced in OXDC-ADV-2026-0003
Disable IMAP compression until patched by removing the imap_capability compression entry or the imap-compress plugin from Dovecot configuration
Audit IMAP accounts for weak or shared credentials that could be leveraged to reach the authenticated attack surface
Rate-limit concurrent IMAP connections per authenticated user at the load balancer or Dovecot mail_max_userip_connections setting

Patch Information

Open-Xchange has released a fixed Dovecot build addressed by advisory OXDC-ADV-2026-0003. Administrators should apply the vendor-supplied package for their distribution and restart the Dovecot service. Confirm the update by inspecting the running version and validating that the compression handling changes are present.

Workarounds

Disable the IMAP COMPRESS extension globally if compression is not required by clients
Reduce the number of connections handled by a single imap-login process via service imap-login { client_limit }, accepting the associated performance overhead
Enforce per-IP and per-user connection limits to constrain the number of parallel compressed sessions an attacker can open
Isolate high-risk tenants onto dedicated imap-login process pools to limit blast radius

bash

# Example Dovecot mitigation: disable IMAP compression
# /etc/dovecot/conf.d/20-imap.conf
protocol imap {
  mail_plugins = $mail_plugins
  # Remove 'imap_compress' from mail_plugins if present
}

# Alternative: limit connections per imap-login process
service imap-login {
  client_limit = 100
  process_limit = 128
}

# Restart Dovecot after changes
systemctl restart dovecot