CVEvulnerability

CVE-2026-42391

7.5 HIGH Published 2026-08-28 Modified 2026-09-03 Official page ↗
Status
Deferred
Published
2026-08-28
Last modified
2026-09-03
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400

Description

An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by the same process. This can cause degradation or denial of service for IMAP logins. Limit the number of connections handled by a single imap-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known.

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References