CVE-2026-40015: Out-of-bounds Read in Open-Xchange GmbH OX Dovecot Pro

This vulnerability involves an out-of-bounds read triggered by an attacker with valid credentials opening many connections to the imap-hibernate service and sending invalid commands. The resulting crash interrupts hibernated IMAP sessions handled by the affected process, leading to potential degradation of IMAP service availability. The CVSS 3.1 base score is 4.3 (medium severity), reflecting the impact on availability without confidentiality or integrity loss. No exploits are publicly known. The vendor recommends disabling IMAP hibernation and updating to a fixed version, though no explicit patch links or fixed versions are provided in the data.

An attacker with valid credentials can cause intermittent crashes of the imap-hibernate service process, interrupting hibernated IMAP sessions and degrading IMAP service availability. There is no impact on confidentiality or integrity reported. The disruption is limited to availability degradation.

The vendor recommends disabling IMAP hibernation to mitigate the issue and updating to a non-vulnerable version when available. Since no explicit patch information is provided, check the vendor advisory for the latest remediation guidance. No public exploits are known, so immediate urgent action is not indicated beyond these steps.