CVE-2026-27852: High severity vulnerability
An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, causing denial of service for the affected user. Update to non-vulnerable version. No publicly available exploits are known.
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Users whose mailboxes receive a specially crafted message are affected when that message is parsed over IMAP. The immediate impact is limited to the affected user's process, which can exceed its memory limit and terminate.
What does an attacker need to exploit the issue?
The attacker needs only the ability to send email to the target user. No authentication, user interaction, or prior privileges are required.
Does the malicious message need to be blocked at delivery time to cause an impact?
No. The message is still delivered; the memory exhaustion occurs later when it is read over IMAP.
Are public exploits available?
No publicly available exploits are known.
What should be done if this issue is identified?
Update to a non-vulnerable version.