CVE-2026-42391: Uncontrolled Resource Consumption in Open-Xchange GmbH OX Dovecot Pro

An unauthenticated attacker can exploit CVE-2026-42391 by sending an IMAP ID command with a very large number of parameters before authentication in OX Dovecot Pro. This causes disproportionate memory and CPU consumption, potentially triggering out-of-memory handling that terminates the login process and all other connections managed by the same process. This results in degradation or denial of service for IMAP logins. The vulnerability affects specific versions of OX Dovecot Pro. No public exploits have been reported. Mitigation involves limiting the number of connections per imap-login process, which may impact performance, or updating to a fixed version.

The vulnerability allows denial of service by causing resource exhaustion (memory and CPU) in the IMAP login process, leading to termination of the login process and all other connections handled by that process. This disrupts IMAP login availability but does not impact confidentiality or integrity. No known exploitation in the wild has been reported.

The vendor recommends limiting the number of connections handled by a single imap-login process to mitigate the issue, though this may affect performance. Additionally, updating to a non-vulnerable version is advised. Patch status is not explicitly confirmed; check the vendor advisory for current remediation guidance.