CVE-2026-40017: Medium severity IMAP THREAD command vulnerability
An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that fix. Whenever a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage, kill the offending process and remove the offending message from the affected mailbox. Update to non-vulnerable version. No publicly available exploits are known.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Monitor system CPU usage for abnormal spikes caused by IMAP THREAD commands on the affected mailbox; if detected, kill the offending process.
- Operational
After killing the offending process, remove the offending message from the affected mailbox.
Event History
Frequently Asked Questions
Who can trigger the issue?
An attacker must be able to send email to a user whose mailbox is processed with the IMAP THREAD command. No authentication to the IMAP service is described as necessary for the attacker.
When does the denial of service occur?
The crafted message causes impact when a mail client issues a THREAD command on the affected mailbox. The command can consume disproportionate CPU and degrade or deny IMAP service.
What can be done if an update cannot be applied immediately?
Monitor for abnormal CPU usage. If the issue is triggered, kill the offending process and remove the offending message from the affected mailbox.
Does the fix for CVE-2026-40014 address this issue?
No. This issue is separate from CVE-2026-40014 and is not addressed by that fix.
Are public exploits available?
No publicly available exploits are known.