PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42006 Open-Xchange GmbH CVE debrief

CVE-2026-42006 is a medium-severity vulnerability in Dovecot's IMAP implementation, published 2026-05-12 and modified 2026-05-18. The issue represents an incomplete fix for CVE-2026-27857, where excessive brace characters in IMAP commands could trigger uncontrolled memory consumption. The original remediation only addressed closing braces, leaving open braces as an attack vector. An authenticated attacker can exploit this to drive memory usage up to configured process limits, resulting in denial of service. Affected versions include Dovecot prior to 2.4.4 and Dovecot Pro prior to 3.1.5. No publicly available exploits are known.

Vendor
Open-Xchange GmbH
Product
OX Dovecot Pro
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-18
Advisory published
2026-05-12
Advisory updated
2026-05-18

Who should care

Organizations running Dovecot IMAP servers, particularly those with external IMAP access enabled and those who applied the CVE-2026-27857 fix without updating to the complete remediation in CVE-2026-42006

Technical summary

The vulnerability stems from insufficient input validation on IMAP command parsing. The fix for CVE-2026-27857 added limits on closing brace characters but failed to apply equivalent restrictions to opening braces. An attacker with valid IMAP credentials can send commands with nested or excessive opening braces, causing the IMAP process to allocate memory without bound until reaching vsz_limit. The attack requires network access to the IMAP service and valid authentication, with no user interaction needed. The CVSS 3.1 score of 4.3 reflects the low availability impact and requirement for authenticated access.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Dovecot to version 2.4.4 or later, or Dovecot Pro to version 3.1.5 or later
  • As interim mitigation, configure vsz_limit for imap processes to a low value to constrain memory consumption
  • Monitor IMAP process memory usage for anomalous spikes that may indicate exploitation attempts
  • Review authentication logs for suspicious IMAP session patterns involving malformed command structures

Evidence notes

CVE description confirms incomplete fix for CVE-2026-27857; NVD CPE data specifies affected version ranges; CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L supports network-based attack with low privileges required

Official resources

2026-05-12