The vulnerability CVE-2026-42006 in OX Dovecot Pro involves uncontrolled resource consumption via excessive IMAP bracing. The prior fix for CVE-2026-27857 addressed only closing braces, leaving open braces as a bypass vector. An attacker can exploit this to cause memory usage to reach the configured memory limit, potentially leading to denial of service. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity) with network attack vector, low complexity, requiring low privileges, no user interaction, and impacts availability only. Red Hat has issued security advisories and patches for affected Dovecot versions in Red Hat Enterprise Linux 10.0 Extended Update Support.

Successful exploitation results in denial of service by exhausting memory resources of the IMAP process, potentially disrupting mail service availability. There is no impact on confidentiality or integrity. No public exploits are known, limiting immediate risk. The vulnerability requires low privileges and network access.

Red Hat has released security updates for Dovecot that fix this vulnerability. Users should apply these official patches as detailed in the Red Hat advisory (RHSA-2026:42091). Alternatively, configuring the vsz_limit for the IMAP process to a low value can mitigate the impact by limiting memory usage. Since a fix is available, applying the update is the recommended remediation.