CVE-2026-27852: Uncontrolled Resource Consumption in Open-Xchange GmbH OX Dovecot Pro

This vulnerability allows an attacker who can send mail to a user to craft a message with headers containing an excessive number of email addresses or MIME parameters. When such a message is parsed by OX Dovecot Pro, it causes uncontrolled resource consumption, specifically excessive memory usage. Although the message is delivered, reading it over IMAP can exhaust the memory limit of the process and cause it to terminate, resulting in a denial of service condition for the user. The CVSS v3.1 score is 7.5, indicating high severity. No official remediation level or patch links are provided in the data, and no known exploits are publicly available.

The impact is a denial of service for the affected user due to process termination caused by memory exhaustion when parsing crafted email headers. There is no confidentiality or integrity impact reported. The attack requires the ability to send mail to the user but does not require authentication or user interaction.

No official patch or remediation guidance is provided in the available data. Users should update to a non-vulnerable version once available. Until then, monitoring and filtering incoming mail to prevent messages with excessive headers may help mitigate the risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.