CVE-2026-42391

CVE-2026-42391 is an uncontrolled resource consumption flaw (CWE-400) in the pre-authentication login handling of Dovecot's IMAP service, rated 7.5 High for availability-only impact. An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, causing memory and CPU usage in the imap-login process to grow disproportionately. When out-of-memory handling terminates that login process, it also kills every other connection multiplexed into the same process, degrading or denying IMAP logins with no confidentiality or integrity impact. Any Dovecot deployment whose imap-login processes handle multiple concurrent connections, especially mail servers exposing IMAP to untrusted clients, is affected. No public proof-of-concept, no CISA KEV listing, no known in-the-wild exploitation, and EPSS is a low 0.4% (31st percentile).

What to do: Upgrade Dovecot to a non-vulnerable version as specified in the Open-Xchange/Dovecot advisory (fixed version numbers were not provided in the available data). Where upgrading is not immediately possible, reduce the number of connections handled by a single imap-login process (e.g., per-connection login handling), accepting a performance cost, and check logs for out-of-memory termination of imap-login processes; consider limiting network exposure of IMAP ports to trusted clients.