CVE-2026-42391: Uncontrolled Resource Consumption in Open-Xchange GmbH OX Dovecot Pro

This vulnerability allows an unauthenticated attacker to send an IMAP ID command with a very large number of parameters before authentication, causing disproportionate memory and CPU consumption. The resulting out-of-memory condition can terminate the login process and all other connections handled by the same process, causing denial of service for IMAP logins. The issue is classified under CWE-400 (Uncontrolled Resource Consumption). No public exploits have been reported. Mitigation involves limiting connections per imap-login process, which impacts performance, or updating to a fixed version.

The vulnerability can cause denial of service by exhausting memory and CPU resources, terminating the login process and disrupting all other connections handled by the same process. This results in degraded or unavailable IMAP login functionality. There is no impact on confidentiality or integrity reported.

A fix is available by updating to a non-vulnerable version of OX Dovecot Pro. Alternatively, limiting the number of connections handled by a single imap-login process can mitigate the issue, though this may reduce performance. Since no patch links are provided, check the vendor advisory for the exact fixed versions and update accordingly.