CVE-2026-40014: Uncontrolled Resource Consumption in Open-Xchange GmbH OX Dovecot Pro

This vulnerability involves uncontrolled resource consumption (CWE-400) in OX Dovecot Pro versions 2.3.0, 3.0.0, and 3.1.0. An attacker able to send mail to a user can craft message headers that cause the IMAP THREAD command to consume disproportionate CPU resources relative to message size. This can degrade or deny IMAP service when a client issues the THREAD command on the affected mailbox. No known public exploits exist. The CVSS 3.1 score is 6.5 (medium severity) with network attack vector, low attack complexity, no privileges required, user interaction required, and impact limited to availability.

The vulnerability can cause high CPU usage on the mail server when processing specially crafted message headers via the IMAP THREAD command, potentially leading to service degradation or denial of service for IMAP clients. There is no impact on confidentiality or integrity. No known exploitation in the wild has been reported.

No official patch or fix is documented in the provided data. Users should monitor systems for abnormal CPU usage related to IMAP THREAD commands, terminate offending processes, and remove malicious messages from affected mailboxes. Updating to a non-vulnerable version is advised once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.