security update for dovecot

CVE-2026-42006 affects the Dovecot IMAP server and allows an attacker to cause uncontrolled memory usage by sending excessive bracing characters over the IMAP protocol. This vulnerability arises because a previous fix for a related issue was incomplete, leaving a bypass via open braces. The excessive memory consumption can reach the configured memory limit, resulting in a denial of service condition. Red Hat has issued security updates for affected versions of Red Hat Enterprise Linux and related products to address this issue. No known public exploits exist currently.

Successful exploitation of this vulnerability can lead to denial of service by exhausting memory resources on the affected Dovecot IMAP server. This could disrupt email services relying on Dovecot but does not indicate code execution or data compromise. No public exploits are known, limiting observed impact so far.

Red Hat has released security updates that fix this vulnerability. Users should apply the provided updates as described in the Red Hat advisory RHSA-2026:42091. The advisory includes instructions for updating affected packages. No additional mitigation steps are indicated or required beyond applying the official patches.