PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42006 Open-Xchange GmbH CVE debrief

CVE-2026-42006 is a medium-severity vulnerability in Dovecot's IMAP implementation, published 2026-05-12 and modified 2026-05-18. The issue represents an incomplete fix for CVE-2026-27857, where excessive brace characters in IMAP commands could trigger uncontrolled memory consumption. The original remediation only addressed closing braces, leaving open braces as an attack vector. An authenticated attacker can exploit this to drive memory usage up to configured process limits, resulting in denial of service. Affected versions include Dovecot prior to 2.4.4 and Dovecot Pro prior to 3.1.5. No publicly available exploits are known.

Vendor
Open-Xchange GmbH
Product
OX Dovecot Pro
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-08-03
Advisory published
2026-05-12
Advisory updated
2026-08-03

Who should care

Organizations running Dovecot IMAP servers, particularly those with external IMAP access enabled and those who applied the CVE-2026-27857 fix without updating to the complete remediation in CVE-2026-42006

Technical summary

The vulnerability stems from insufficient input validation on IMAP command parsing. The fix for CVE-2026-27857 added limits on closing brace characters but failed to apply equivalent restrictions to opening braces. An attacker with valid IMAP credentials can send commands with nested or excessive opening braces, causing the IMAP process to allocate memory without bound until reaching vsz_limit. The attack requires network access to the IMAP service and valid authentication, with no user interaction needed. The CVSS 3.1 score of 4.3 reflects the low availability impact and requirement for authenticated access.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Dovecot to version 2.4.4 or later, or Dovecot Pro to version 3.1.5 or later
  • As interim mitigation, configure vsz_limit for imap processes to a low value to constrain memory consumption
  • Monitor IMAP process memory usage for anomalous spikes that may indicate exploitation attempts
  • Review authentication logs for suspicious IMAP session patterns involving malformed command structures

Evidence notes

CVE description confirms incomplete fix for CVE-2026-27857; NVD CPE data specifies affected version ranges; CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L supports network-based attack with low privileges required

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42006 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42006

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42006 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42006

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json

    [email protected] - Issue Tracking

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.