CVE-2026-73209: IMAP Service DOS Vulnerability via Compressed Data

CVE-2026-73209 Overview

CVE-2026-73209 affects the Dovecot IMAP server, distributed by Open-Xchange. An authenticated attacker can send crafted compressed data that recursively consumes the stack of the processing thread. The affected process exhausts its stack and crashes, terminating the IMAP worker and disrupting mail service for connected users.

The issue is tracked under CWE-674: Uncontrolled Recursion and requires valid account credentials to reach the vulnerable code path. No publicly available exploits are known at the time of publication.

Critical Impact
Authenticated attackers can crash Dovecot IMAP worker processes on demand, causing service degradation or full denial of service for mailbox access.

Affected Products

Open-Xchange Dovecot IMAP server (versions listed in Open-Xchange Security Advisory OXDC-ADV-2026-0003)
Deployments exposing IMAP with compression extensions enabled
Multi-tenant mail platforms built on vulnerable Dovecot builds

Discovery Timeline

2026-08-28 - CVE-2026-73209 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-73209

Vulnerability Analysis

The vulnerability resides in the compressed-data handling path of the Dovecot IMAP process. An attacker authenticates with valid credentials, then submits a crafted compressed payload that the decoder processes with unbounded recursion. Each recursive call consumes an additional stack frame until the process exceeds its stack limit.

Stack exhaustion terminates the affected worker with a fatal signal. Because IMAP sessions and shared workers can serve multiple users, a single malicious client can degrade availability well beyond its own session. Repeated crashes prevent legitimate users from completing IMAP transactions such as folder synchronization or message retrieval.

The attack requires network reach to the IMAP listener and a valid account, but does not require elevated privileges or user interaction. Confidentiality and integrity are not directly impacted.

Root Cause

The root cause is uncontrolled recursion [CWE-674] in the compressed input parser. The decoder does not enforce a maximum recursion depth or convert the traversal into an iterative loop. Crafted compressed structures with deeply nested elements drive the call chain past the operating system stack limit.

Attack Vector

Exploitation follows a straightforward sequence. The attacker connects to the IMAP service over the network, authenticates with any valid mailbox credential, and issues a command path that reaches the compression handler with attacker-controlled data. The malformed payload triggers recursion until the process crashes.

No local access, no user interaction, and no privilege escalation is needed. Credential harvesting through phishing or credential stuffing can supply the required authentication step.

See the Open-Xchange Security Advisory OXDC-ADV-2026-0003 for protocol-level technical details.

Detection Methods for CVE-2026-73209

Indicators of Compromise

Repeated Dovecot IMAP worker crashes with SIGSEGV or stack overflow signatures in /var/log/dovecot.log or systemd journal entries for dovecot.service.
Core dumps from imap or imap-login processes showing deep recursive call stacks in the compression handler.
IMAP session termination events correlated to a single authenticated user or source IP.

Detection Strategies

Alert on process crash events for Dovecot workers, especially bursts from one account or client IP.
Correlate IMAP authentication logs with subsequent worker terminations to identify accounts abusing the flaw.
Baseline normal IMAP compression traffic sizes and flag sessions submitting anomalously structured compressed payloads.

Monitoring Recommendations

Forward Dovecot logs and systemd unit status to a centralized logging platform for correlation.
Track authentication-to-crash ratios per account to surface abuse patterns.
Monitor IMAP service availability with synthetic transactions to detect degradation early.

How to Mitigate CVE-2026-73209

Immediate Actions Required

Update Dovecot to the non-vulnerable version specified in Open-Xchange Security Advisory OXDC-ADV-2026-0003.
Audit IMAP accounts and rotate credentials for accounts with weak or reused passwords to reduce the pool of usable attackers.
Enforce rate limiting and connection limits per source IP and per authenticated user on the IMAP listener.

Patch Information

Open-Xchange has released fixed builds referenced in advisory OXDC-ADV-2026-0003. Administrators should apply the vendor-supplied patch as the primary remediation. Restart Dovecot services after upgrade to ensure all worker processes load the patched binaries.

Workarounds

Restrict IMAP access to trusted networks or VPN clients until patching completes.
Disable IMAP compression extensions if operationally acceptable, removing the vulnerable code path.
Enforce multi-factor authentication on mailbox accounts to limit exploitation from stolen credentials.

bash

# Configuration example: verify Dovecot version and restart after patching
dovecot --version
systemctl restart dovecot
journalctl -u dovecot -f | grep -Ei 'segfault|stack|abort'