CVE-2026-27852

This is an unauthenticated denial-of-service flaw in the IMAP message-parsing component maintained by Open-Xchange (per the CNA, Dovecot, the widely used open-source IMAP server). An attacker who can send email to a victim crafts a message whose headers contain a very large number of email addresses or MIME parameters; the message is delivered normally, but when the user later reads it over IMAP, parsing the headers consumes excessive memory and exceeds the process memory limit, terminating the process. The impact is a denial of service for that user's mail access (CVSS availability-high, no confidentiality or integrity impact). Any Dovecot-based IMAP deployment that accepts inbound email from untrusted senders is affected, and any mailbox user can be targeted individually. No public PoC or known exploitation exists; EPSS estimates only a 0.4% chance of exploitation in the next 30 days.

What to do: Upgrade Dovecot to the non-vulnerable version per the Open-Xchange advisory (specific fixed versions are not listed in the available data). As interim mitigations, enforce per-process memory limits and reasonable header/address/parameter limits on inbound mail at the SMTP gateway (e.g., restrict the number of recipients and header size accepted), and monitor for IMAP process crashes or restarts on affected mailboxes.