CVE-2026-33607: Medium severity vulnerability
An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. No publicly available exploits are known.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Monitor the system for abnormal CPU usage caused by IMAP LIST command activity; identify and kill the offending process and lock the affected account.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs valid credentials and access to the IMAP service. The attack is performed using the IMAP LIST command.
What is the likely impact?
Repeated or abusive use of the LIST command can consume CPU resources, degrading IMAP performance or causing a denial of service for IMAP users.
What can be done if the fixed version cannot be installed immediately?
Monitor systems for abnormal CPU usage. If an offending process is identified, kill the process and lock the associated account.
Are public exploits available?
No publicly available exploits are known.