PT-2026-40030 · Dovecot+4 · Dovecot+4

Bzimport · CVE-2026-42006 · Published 2026-05-12 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.4-1.1

Description An attacker can cause uncontrolled memory usage via excessive bracing over IMAP. A previous fix was incomplete as it only blocked closing braces, allowing the memory limit to be bypassed using open braces. This can lead to memory consumption reaching the configured limit.

Recommendations Update to version 2.4.4-1.1. Configure vsz limit for the imap process to a low value.

Exploit

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

ALSA-2026:41905

ALSA-2026:41988

ALSA-2026:46532

BDU:2026-10389

CVE-2026-42006

OESA-2026-2722

OPENSUSE-SU-2026:10766-1

OPENSUSE-SU-2026:21109-1

RHSA-2026:41905

RHSA-2026:41988

RHSA-2026:42091

SUSE-SU-2026:22185-1

SUSE-SU-2026:2645-1

USN-8365-1

Affected Products

Dovecot

Linuxmint

Red Os

Rocky Linux

Ubuntu

References · 75

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42006.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-33603 · Security Note
• https://linux.oracle.com/errata/ELSA-2026-41905.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:41988 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:41988 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:46380 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:41905 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:46532 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-46532.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42006 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:46532 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8365-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:44357 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2722 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:41905 · Vendor Advisory