CVE-2026-40017: Uncontrolled Resource Consumption in Open-Xchange GmbH OX Dovecot Pro
Description
CVE-2026-40017 is a vulnerability in Open-Xchange GmbH OX Dovecot Pro where an attacker sending mail to a user can craft message headers that cause excessive CPU consumption when the IMAP THREAD command is issued. This leads to potential degradation or denial of service for IMAP. The issue is distinct from CVE-2026-40014 and is not fixed by that patch. No public exploits are known. Affected versions include 2.3.0, 3.0.0, and 3.1.0.
CVSS v3.1
Score 6.5medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from uncontrolled resource consumption due to hash collisions in an internal hash table triggered by specially crafted message headers. When a mail client issues the IMAP THREAD command on a mailbox containing such a message, CPU usage spikes disproportionately to the message size, potentially causing service degradation or denial of service. The flaw is specific to OX Dovecot Pro versions 2.3.0, 3.0.0, and 3.1.0 and is separate from CVE-2026-40014. There are no known public exploits targeting this vulnerability.
Potential Impact
An attacker capable of sending mail to a user can cause high CPU usage on the IMAP server when the THREAD command is executed, leading to performance degradation or denial of service for IMAP clients accessing the affected mailbox. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
No official patch or fix is currently documented. Recommended mitigation includes monitoring the system for abnormal CPU usage, terminating the offending process, and removing the crafted message from the affected mailbox. Users should update to a non-vulnerable version once available. Since no patch links are provided, check the vendor advisory for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-gr5f-599w-cg8j
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-40017"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a91a7bdacd9273b49065182
Added to database: 08/28/2026, 15:22:37 UTC
Last enriched: 09/10/2026, 02:22:50 UTC
Last updated: 10/13/2026, 18:48:19 UTC
Views: 32
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.