CVE-2026-52687: Uncontrolled Resource Consumption in Open-Xchange GmbH OX Dovecot Pro

This vulnerability allows an attacker with valid credentials to select a compression algorithm for IMAP connections whose decompression state requires a large amount of memory. By opening multiple such connections, the attacker can exhaust the memory limit of the imap-login process, causing it to terminate and disrupt all handled connections. This results in degradation or denial of service for the IMAP service in OX Dovecot Pro. The vulnerability is tracked as CVE-2026-52687 with a CVSS score of 6.5 (medium severity). No public exploits are currently known. Mitigation options include disabling IMAP compression or limiting the number of connections per imap-login process, though the latter may impact performance. Updating to a non-vulnerable version is advised.

An attacker with valid credentials can cause denial of service by exhausting memory resources through crafted IMAP compression algorithm selection, leading to process termination and service disruption. There is no impact on confidentiality or integrity reported.

Disable IMAP compression to prevent exploitation. Alternatively, limit the number of connections handled by a single imap-login process, understanding this may reduce performance. Update to a non-vulnerable version when available. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.