CVE-2026-42006: 
Dovecot vulnerability analysis and mitigation

CVE-2026-42006 is an uncontrolled resource consumption vulnerability in Dovecot's IMAP server that allows an authenticated attacker to cause excessive memory usage through crafted IMAP requests containing excessive open braces. It represents an incomplete fix for a prior related vulnerability, CVE-2026-27857, which only blocked closing braces but left open braces as a viable bypass. Affected products include Dovecot (community edition) versions before 2.4.4 and OX Dovecot Pro versions before 3.1.5 (and before 3.0.5 in the 3.0.x branch). The vulnerability was published on May 12, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, ENISA EUVD).

The root cause is CWE-400 (Uncontrolled Resource Consumption): Dovecot's IMAP parser does not properly enforce limits on the number of open braces in IMAP protocol messages. The prior patch for CVE-2026-27857 addressed excessive closing braces but failed to account for the symmetric case of excessive open braces, leaving the resource exhaustion vector open. An authenticated attacker can send IMAP requests with a large number of open braces, causing the IMAP process to consume memory up to the configured vsz_limit. No special privileges beyond valid IMAP credentials are required, and the attack is conducted entirely over the network (GitHub Advisory, OX Advisory).

Successful exploitation results in a denial-of-service condition limited to the IMAP process: an authenticated attacker can exhaust memory up to the configured vsz_limit, causing service degradation or unavailability for other IMAP users. There is no impact on confidentiality or integrity — the vulnerability is purely an availability issue. The blast radius is constrained to the IMAP service and does not facilitate lateral movement or data exfiltration (GitHub Advisory, ENISA EUVD).

1. Obtain IMAP credentials: Acquire valid credentials for the target Dovecot IMAP server through phishing, credential stuffing, or other means — authentication is required.
2. Connect to the IMAP server: Establish a TCP connection to the target on port 143 (IMAP) or 993 (IMAPS) and authenticate with the obtained credentials.
3. Craft a malicious IMAP command: Construct an IMAP command containing an excessive number of open braces (e.g., a deeply nested or repeated { sequence) in a parameter field that the IMAP parser processes.
4. Send the payload: Transmit the crafted command to the server. The IMAP parser processes the open braces without enforcing an adequate limit, causing the process to allocate memory proportional to the brace count.
5. Exhaust memory: Repeat or scale the request to drive memory consumption up to the configured vsz_limit, causing the IMAP process to become unresponsive or crash, denying service to other users (GitHub Advisory, OX Advisory).

• Network: Unusual volume of IMAP connections from a single authenticated user; large or malformed IMAP protocol messages containing repeated { characters in command parameters.
• Logs: Dovecot IMAP logs showing repeated commands with abnormally long or deeply nested brace sequences; OOM (out-of-memory) killer events or process crashes logged in system logs (/var/log/syslog, /var/log/messages) attributed to the imap process.
• Process: Dovecot imap child processes consuming memory near or at the configured vsz_limit; sudden termination of IMAP worker processes followed by respawn events in the Dovecot master process log.

Upgrade to Dovecot 2.4.4 or later (community edition), or OX Dovecot Pro 3.1.5 or later (3.0.x branch: 3.0.5 or later) to fully remediate the vulnerability (OX Advisory). As an interim workaround, configure the vsz_limit parameter for the IMAP process to a low value in dovecot.conf to cap per-process memory usage and limit the impact of exploitation. Distribution-specific patches have been released for Ubuntu (USN-8365-1), Debian LTS (DLA-4617-1), openSUSE, and Fedora 43/44 (Ubuntu Advisory, Debian LTS, openSUSE).

The vulnerability was disclosed via the oss-security mailing list and full-disclosure list in May 2026, generating routine security community attention (oss-sec, Full Disclosure). A technical write-up was published by Infinitsec noting the Proxmox/IMAP context of the memory consumption issue (Infinitsec). Major Linux distributions responded promptly with security updates, and Tenable released multiple Nessus detection plugins. Overall community reaction reflects the moderate severity rating — the vulnerability is considered a low-urgency patch given the authentication requirement and lack of known exploitation.