The vulnerability arises from the handling of the NOOP command in OX Dovecot Pro, where a command containing 4000 open and close parentheses results in approximately 1MB of additional memory allocation. If the command's ending line feed is not sent, this memory remains allocated longer. An attacker can exploit this by establishing many simultaneous connections (e.g., 1000) from a single IP address, cumulatively consuming large amounts of memory (~1GB), which may reach the virtual memory size (VSZ) limit and cause the Dovecot process and its proxied connections to be killed. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The vendor advisory from Red Hat confirms a security update is available for affected versions, specifically for Red Hat Enterprise Linux 7 Extended Lifecycle Support. The CVSS v3.1 base score is 4.3 (medium severity), reflecting a network attack vector with low complexity and no user interaction required, causing availability impact only. No known public exploits exist.

Successful exploitation leads to denial of service by exhausting server memory resources, causing the Dovecot process to terminate and disrupt service for all proxied connections. There is no confidentiality or integrity impact reported. The attack can be performed remotely over the network with low complexity and no user interaction, making it feasible to disrupt mail services.

A fixed version of OX Dovecot Pro is available and should be installed to remediate this vulnerability. The Red Hat advisory (RHSA-2026:26564) provides updated packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support. No other mitigations are recommended or effective. Administrators should apply the official security update promptly to prevent denial of service conditions. There are no known workarounds or temporary fixes.