CVE-2026-52687: Uncontrolled Resource Consumption in Open-Xchange GmbH OX Dovecot Pro

This vulnerability allows an attacker with valid credentials to select a compression algorithm for the IMAP connection whose decompression state consumes a large amount of memory. By opening multiple such connections, the attacker can exhaust the memory limit of the process, causing it to terminate and disrupt all handled connections, resulting in denial of service. The vulnerability affects specific versions of OX Dovecot Pro (2.3.11, 3.0.0, 3.1.0). No public exploits are currently known.

The impact is denial of service (DoS) on the IMAP service due to process termination caused by memory exhaustion. There is no impact on confidentiality or integrity. The CVSS score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on availability.

Disabling IMAP compression prevents exploitation of this vulnerability. Alternatively, limiting the number of connections handled by a single imap-login process can mitigate the issue but may degrade performance. Users are advised to update to a non-vulnerable version when available. Patch status is not yet confirmed; check the vendor advisory for current remediation guidance.