CVE-2026-42006: High severity Dovecot dovecot vulnerability
An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit. Using excessive bracing, attacker can cause memory usage up to configured memory limit. Install fixed version, or configure vszlimit for imap process to low value. No publicly available exploits are known.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/dovecotto a version that resolves this vulnerability.Fixed in 1:2.3.19.1+dfsg1-2.1+deb12u6Fixed in 1:2.4.1+dfsg1-6+deb13u6Fixed in 1:2.4.4+dfsg1-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2026-27857 - Configuration
Configure vsz_limit for the IMAP process to a low value so excessive bracing cannot grow memory usage up to the configured limit (ensure vsz_limit is set low).
IMAP process vsz_limit = low value
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42006?
CVE-2026-42006 has a high severity due to its potential to cause uncontrolled memory usage.
How do I fix CVE-2026-42006?
To fix CVE-2026-42006, ensure that you apply the latest patches or updates for Dovecot that address this vulnerability.
What products are affected by CVE-2026-42006?
CVE-2026-42006 affects the Dovecot email server software.
Can CVE-2026-42006 be exploited remotely?
Yes, CVE-2026-42006 can be exploited remotely, allowing unauthorized users to impact server performance.
What should I monitor to detect CVE-2026-42006 exploitation attempts?
Monitor for unusual memory usage patterns and authentication attempts on your Dovecot server to detect potential exploitation of CVE-2026-42006.