CVE-2026-127141: SOGo before 5.12.13 Denial of Service via Auxiliary IMAP Account Greeting Wait
SOGo before 5.12.13 contains a denial of service vulnerability that allows authenticated attackers to exhaust all worker processes by configuring an auxiliary IMAP mail account pointing to a controlled host that accepts a TCP connection but never sends an IMAP greeting response. Attackers can issue concurrent GET requests to the mail view of this account to hold workers indefinitely without an effective timeout, occupying every SOGo worker and denying service to all users for approximately five minutes until the watchdog kills and respawns the stuck workers.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SOGoto a version that resolves this vulnerability.Fixed in 5.12.13
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to SOGo and able to configure an auxiliary IMAP mail account. They also need to control, or be able to direct that account to, a host that accepts TCP connections but does not send an IMAP greeting.
What conditions are required for service disruption?
The attacker sends concurrent GET requests to the mail view for the malicious auxiliary account. Each request can hold a SOGo worker while it waits indefinitely for the IMAP greeting, allowing all workers to be exhausted.
How long does the disruption last?
Service is denied until the watchdog kills and respawns the stuck workers, which occurs after approximately five minutes.
What version resolves the issue?
The issue affects SOGo versions before 5.12.13. Upgrading to SOGo 5.12.13 or later addresses the affected version range.