CVE-2026-40014: Medium severity vulnerability
An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage, kill the offending process and remove the offending message from the affected mailbox. Update to non-vulnerable version. No publicly available exploits are known.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Monitor system for abnormal CPU usage when IMAP THREAD is issued; if CPU spikes due to the THREAD command, kill the offending process.
- Operational
After killing the offending process, remove the offending message from the affected mailbox.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Mail users whose affected mailbox can receive attacker-supplied email are exposed. The impact occurs when a mail client issues an IMAP THREAD command against the mailbox containing the crafted message.
What does an attacker need to exploit it?
The attacker only needs to be able to send a crafted email to a user. No authentication or prior privileges are required, but user interaction is required because a mail client must issue the THREAD command.
What can be done if an update cannot be applied immediately?
Monitor for abnormal CPU usage associated with IMAP processing. If the issue is triggered, kill the offending process and remove the offending message from the affected mailbox.
How can an organization tell whether it is being affected?
Abnormal CPU consumption when IMAP THREAD is run on a mailbox is an indicator. Investigate messages in the affected mailbox for a crafted header and remove the offending message.