CVE-2026-52687: Medium severity Dovecot IMAP imap-login vulnerability
An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections. The memory limit of the process is reached with only a few connections, terminating the process and all connections it handles, which can cause degradation or denial of service for IMAP. Disable IMAP compression. Alternatively limit the number of connections handled by a single imap-login process, though this has a performance impact. Update to non-vulnerable version. No publicly available exploits are known.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable IMAP compression to prevent attackers with valid credentials from selecting a compression algorithm that causes excessive memory use during decompression.
IMAP server IMAP compression = disabled - Compensating control
Limit the number of connections handled by a single imap-login process (noting this has a performance impact) to reduce the impact of memory exhaustion.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs valid IMAP credentials and network access to establish IMAP connections. No user interaction is required.
Are systems affected by default?
The issue requires IMAP compression to be enabled. Disabling IMAP compression prevents the described attack path.
What can be done if an update cannot be applied immediately?
Disable IMAP compression. Alternatively, limit the number of connections handled by each imap-login process, recognizing that this can reduce performance.
How does exploitation affect the service?
A small number of crafted compressed IMAP connections can exhaust the process memory limit, terminate that process, and drop all connections it handles. This can degrade or deny IMAP service.
Are public exploits available?
No publicly available exploits are known.