CVE-2026-73209: 
Dovecot vulnerability analysis and mitigation

CVE-2026-73209 is a Denial of Service vulnerability in Open-Xchange's Dovecot IMAP server caused by uncontrolled recursion when processing crafted compressed data. An authenticated attacker can send specially crafted compressed data that exhausts the process stack, causing the IMAP process to crash. Affected products include OX Dovecot Pro (versions 2.3.0–2.3.22.2, 3.0.0–3.0.7, and 3.1.0–3.1.6) and OX Dovecot CE (versions 2.3.0–2.4.5). The vulnerability was published on August 28, 2026, with patches available. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is uncontrolled recursion (CWE-674) and allocation of resources without limits or throttling (CWE-770) in Dovecot's compressed data handling code. When an authenticated user submits specially crafted compressed data over IMAP, the server's decompression or parsing routine enters unbounded recursive calls, exhausting the process stack until a crash occurs. Exploitation requires valid IMAP credentials (low privilege), is network-accessible, and requires no user interaction. No public proof-of-concept or technical write-up detailing the specific code path has been published (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in termination of the affected IMAP process, causing denial of service or degradation of IMAP functionality for all users of the affected Dovecot instance. There is no impact on confidentiality or data integrity — the vulnerability is purely an availability issue. Repeated exploitation could sustain a persistent outage of email access for organizations relying on Dovecot as their IMAP server (GitHub Advisory).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.32%, indicating a low near-term probability of exploitation. Exploitation is not automatable per NVD SSVC assessment, as valid credentials are required (GitHub Advisory, Red Hat Bugzilla).

1. Obtain valid IMAP credentials: Acquire legitimate user credentials for the target Dovecot IMAP server through phishing, credential stuffing, or other means.
2. Connect to the IMAP server: Establish an authenticated IMAP session to the target server using a standard IMAP client or scripted tool (e.g., openssl s_client, curl, or a custom script).
3. Enable IMAP compression: Negotiate IMAP compression (e.g., via the COMPRESS=DEFLATE IMAP extension) if supported and enabled on the server.
4. Send crafted compressed data: Transmit specially crafted compressed data designed to trigger unbounded recursion in the server's decompression or parsing routine.
5. Observe process crash: The Dovecot IMAP process exhausts its stack and crashes, causing denial of service for all IMAP users on the affected instance. Repeat as needed to sustain the outage.

• Logs: Unexpected Dovecot IMAP process crash entries in system logs (e.g., /var/log/mail.log, /var/log/dovecot.log); segmentation fault or stack overflow messages associated with the imap or imap-login process.
• Process: Sudden termination of the dovecot/imap child process; repeated respawning of the IMAP worker process in a short time window.
• Network: Authenticated IMAP sessions from unexpected source IPs followed immediately by service disruption; unusual IMAP COMPRESS command negotiation patterns in network captures.

Upgrade to a patched version of Dovecot: OX Dovecot Pro 2.3.22.2, 3.0.7, or 3.1.6; OX Dovecot CE 2.4.5 or later. As a temporary workaround, restrict IMAP access to trusted and known users only to reduce the attack surface, since exploitation requires valid credentials. Monitoring for unexpected IMAP process crashes can help detect exploitation attempts until patching is complete (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was disclosed by Open-Xchange via a CSAF advisory and tracked by Red Hat's Product Security team. Distribution-level advisories were issued by SUSE, openSUSE, and Mageia, and the issue was discussed on the oss-security and Full Disclosure mailing lists. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking and distribution patching activity.