CVE-2026-40014: Uncontrolled Resource Consumption in Open-Xchange GmbH OX Dovecot Pro

This vulnerability in OX Dovecot Pro arises from uncontrolled resource consumption triggered by a specially crafted message header that causes the IMAP THREAD command to use disproportionate CPU relative to message size. An attacker able to send mail to a user can exploit this to degrade or deny IMAP service by causing high CPU load when the THREAD command is issued. The affected versions explicitly include 2.3.0, 3.0.0, and 3.1.0. There is no vendor advisory or patch information provided, and no known public exploits exist.

The impact is denial of service or degradation of IMAP service availability due to excessive CPU consumption triggered by the THREAD command on crafted message headers. Confidentiality and integrity are not affected. The CVSS score of 6.5 reflects a medium severity with no privileges required but user interaction needed (UI:R).

No official patch or remediation level is provided in the available data. Recommended mitigation includes monitoring the system for abnormal CPU usage, terminating offending processes, and removing the malicious message from the mailbox. Users should update to a non-vulnerable version when such a version becomes available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.