PT-2026-40030 · Dovecot · Dovecot

Published 2026-05-12 · Updated 2026-06-02 · CVE-2026-42006

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.4-1.1

Description An attacker can cause uncontrolled memory usage via excessive bracing over IMAP. A previous fix was incomplete as it only blocked closing braces, allowing the memory limit to be bypassed using open braces. This can lead to memory consumption reaching the configured limit.

Recommendations Update to version 2.4.4-1.1. Configure vsz limit for the imap process to a low value.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-42006

OPENSUSE-SU-2026:10766-1

USN-8365-1

Affected Products

Dovecot

References · 21

• https://nvd.nist.gov/vuln/detail/CVE-2026-42006 · Security Note
• https://ubuntu.com/security/CVE-2026-40020 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8365-1 · Vendor Advisory
• https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42006 · Security Note
• https://ubuntu.com/security/CVE-2026-33603 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42006 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10766-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8365-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40016 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-42006 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42006 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42006 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27851 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-42006 · Note