CVE-2026-42391: High severity Dovecot IMAP login (imap-login) vulnerability
An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by the same process. This can cause degradation or denial of service for IMAP logins. Limit the number of connections handled by a single imap-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated network client that can reach the Dovecot IMAP login service can send the malicious IMAP ID command before logging in. No user interaction or valid credentials are required.
What is the operational impact of a successful attack?
The attack can drive disproportionate memory and CPU consumption in an imap-login process. If out-of-memory handling terminates that process, all other connections handled by the same process are also terminated, degrading or denying IMAP login service.
What can be done if an update cannot be applied immediately?
Limit the number of connections handled by each imap-login process to reduce the number of clients affected when a process is terminated. This mitigation has a performance impact.
Are public exploits available?
No publicly available exploits are known.