The vulnerability in OX Dovecot Pro involves uncontrolled resource consumption triggered by sending a NOOP command containing 4000 pairs of parentheses. This causes about 1 MB of additional memory allocation per connection, which can be sustained by omitting the command-ending line feed. An attacker can open many such connections from a single IP to consume large amounts of memory (e.g., 1000 connections causing ~1 GB memory usage), potentially reaching the virtual memory size (VSZ) limit and causing the process and its proxied connections to be terminated. The issue results in denial of service through resource exhaustion. The vendor recommends installing a fixed version as the only remediation. No exploits are publicly known.

The impact is limited to denial of service via resource exhaustion. The vulnerability does not affect confidentiality or integrity but can cause the OX Dovecot Pro process to be killed due to reaching memory limits, disrupting service availability and affecting other proxied connections. The CVSS score is 4.3 (medium severity), reflecting the lack of confidentiality or integrity impact and the requirement for low privileges to exploit.

A fixed version of OX Dovecot Pro is available and should be installed to remediate this vulnerability. There are no alternative mitigations. No public exploits are known, so patching is the recommended and only effective remediation.