CVE-2026-52687: 
Dovecot vulnerability analysis and mitigation

CVE-2026-52687 is a denial-of-service vulnerability in Open-Xchange Dovecot (both Community Edition and Pro) caused by uncontrolled memory consumption during IMAP compression negotiation. An authenticated attacker can select a memory-intensive compression algorithm and open multiple IMAP connections, exhausting the process memory limit and crashing the imap-login process for all users it serves. Affected versions include OX Dovecot Pro 2.3.11–2.3.22.2, 3.0.0–3.0.7, and 3.1.0–3.1.6, and OX Dovecot CE 2.3.11–2.4.5. It was published on August 28, 2026, with a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). When an authenticated IMAP client negotiates a compression algorithm whose decompression state requires a disproportionately large amount of memory, Dovecot's imap-login process does not enforce adequate per-connection memory limits. By opening only a small number of such connections simultaneously, an attacker can push the process past its memory ceiling, causing it to terminate and drop all connections it was handling. No public proof-of-concept exploit code is known at this time (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in a denial of service affecting IMAP availability for all users whose connections are handled by the crashed imap-login process. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Because a single imap-login process may serve many concurrent users, even a low-volume attack by a single authenticated user can cause widespread service disruption for legitimate email clients (GitHub Advisory).

No public proof-of-concept exploit code exists, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires valid IMAP credentials (low privileges), making it accessible to any authenticated user but not to unauthenticated attackers. The EPSS score is approximately 0.321%, indicating a low near-term exploitation probability. The NVD SSVC assessment classifies exploitation as "none" and the attack as not automatable. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Red Hat Bugzilla).

1. Obtain valid credentials: Acquire a legitimate IMAP account on a target Dovecot server running a vulnerable version (OX Dovecot Pro < 2.3.22.2 / < 3.0.7 / < 3.1.6, or OX Dovecot CE < 2.4.5).
2. Connect and negotiate compression: Establish an IMAP connection and issue the COMPRESS command (RFC 4978) selecting a compression algorithm whose decompression state is known to require excessive memory.
3. Open multiple connections: Repeat step 2 to open several simultaneous IMAP connections, each holding a large decompression state in memory within the same imap-login process.
4. Exhaust process memory: With only a small number of connections, the cumulative memory usage reaches the imap-login process limit, causing the process to terminate.
5. Achieve denial of service: All IMAP sessions handled by the crashed process are dropped, denying service to all affected users until the process restarts (GitHub Advisory, Red Hat Bugzilla).

• Logs: Dovecot logs showing repeated COMPRESS command usage from a single authenticated user or IP address; imap-login process crash entries (e.g., out of memory or process termination signals) in /var/log/dovecot.log or system journal.
• Process: Sudden termination of the imap-login process followed by automatic restart; elevated memory usage of imap-login processes visible via top or ps before crash.
• Network: Multiple simultaneous IMAP connections from the same source IP, particularly with compression negotiation; unusual connection patterns where sessions are established but minimal mail activity occurs.

The primary remediation is to upgrade to a patched version: OX Dovecot Pro 2.3.22.2, 3.0.7, or 3.1.6; OX Dovecot CE 2.4.5 or later. If immediate patching is not feasible, disable IMAP compression entirely in the Dovecot configuration (remove or disable the imap_compress plugin) as a temporary workaround. An alternative workaround is to limit the number of connections handled by a single imap-login process, though this carries a performance penalty. Patches and advisories are available from Open-Xchange (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was disclosed via the Open-Xchange security advisory (CSAF format) and picked up by multiple Linux distribution security teams, including SUSE, openSUSE, and Mageia, which issued their own advisories and package updates. Red Hat tracked the issue via Bugzilla and the oss-security mailing list carried a disclosure post. Coverage has been routine and limited to security aggregators and distribution security channels, with no notable researcher commentary or significant social media discussion observed.