CVE-2026-42006: Uncontrolled Resource Consumption in Open-Xchange GmbH OX Dovecot Pro
CVE-2026-42006 is a vulnerability in the Dovecot IMAP server that allows an attacker to cause uncontrolled memory usage by sending excessive bracing characters over IMAP. The previous fix for a related issue was incomplete, leaving a bypass via open braces. This can lead to memory consumption up to the configured memory limit, resulting in a denial of service. No public exploits are known. Red Hat has released security updates addressing this issue for multiple versions of Red Hat Enterprise Linux and related products.
AI Analysis
Technical Summary
CVE-2026-42006 is a denial of service vulnerability in Dovecot, an IMAP server, caused by excessive IMAP bracing that leads to uncontrolled resource consumption. This can cause the service to become unavailable. The vulnerability is tracked under CWE-770 and CWE-400, relating to allocation of resources without limits and uncontrolled resource consumption. Red Hat has released security updates for affected versions of Dovecot in Red Hat Enterprise Linux 9 and 10, including Extended Update Support releases. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, indicating network attack vector, low complexity, requires low privileges, no user interaction, unchanged scope, no confidentiality or integrity impact, but availability impact is low.
Potential Impact
Successful exploitation of this vulnerability can cause a denial of service by exhausting server resources through excessive IMAP bracing. This results in degraded or unavailable mail services on affected systems. There is no impact on confidentiality or integrity reported. The vulnerability is rated medium severity with a CVSS score of 4.3.
Mitigation Recommendations
Red Hat has released official security updates that fix this vulnerability in Dovecot packages for Red Hat Enterprise Linux 9 and 10, including Extended Update Support versions. Users should apply the updates as described in the Red Hat advisories RHSA-2026:42091 and RHSA-2026:41905. Detailed update instructions are available at https://access.redhat.com/articles/11258. Applying these updates mitigates the vulnerability by preventing excessive IMAP bracing from causing resource exhaustion.
CVE-2026-42006: Uncontrolled Resource Consumption in Open-Xchange GmbH OX Dovecot Pro
Description
CVE-2026-42006 is a vulnerability in the Dovecot IMAP server that allows an attacker to cause uncontrolled memory usage by sending excessive bracing characters over IMAP. The previous fix for a related issue was incomplete, leaving a bypass via open braces. This can lead to memory consumption up to the configured memory limit, resulting in a denial of service. No public exploits are known. Red Hat has released security updates addressing this issue for multiple versions of Red Hat Enterprise Linux and related products.
CVSS v3.1
Score 4.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-42006 is a denial of service vulnerability in Dovecot, an IMAP server, caused by excessive IMAP bracing that leads to uncontrolled resource consumption. This can cause the service to become unavailable. The vulnerability is tracked under CWE-770 and CWE-400, relating to allocation of resources without limits and uncontrolled resource consumption. Red Hat has released security updates for affected versions of Dovecot in Red Hat Enterprise Linux 9 and 10, including Extended Update Support releases. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, indicating network attack vector, low complexity, requires low privileges, no user interaction, unchanged scope, no confidentiality or integrity impact, but availability impact is low.
Potential Impact
Successful exploitation of this vulnerability can cause a denial of service by exhausting server resources through excessive IMAP bracing. This results in degraded or unavailable mail services on affected systems. There is no impact on confidentiality or integrity reported. The vulnerability is rated medium severity with a CVSS score of 4.3.
Mitigation Recommendations
Red Hat has released official security updates that fix this vulnerability in Dovecot packages for Red Hat Enterprise Linux 9 and 10, including Extended Update Support versions. Users should apply the updates as described in the Red Hat advisories RHSA-2026:42091 and RHSA-2026:41905. Detailed update instructions are available at https://access.redhat.com/articles/11258. Applying these updates mitigates the vulnerability by preventing excessive IMAP bracing from causing resource exhaustion.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:42091
- Cve Count
- 1
- Additional Cves
- []
- Cvss Version
- null
Threat ID: 6a5e79ed2a4a8d59899bb941
Added to database: 07/20/2026, 19:41:33 UTC
Last enriched: 08/03/2026, 23:07:46 UTC
Last updated: 09/04/2026, 04:30:46 UTC
Views: 79
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.