A specially crafted NOOP command containing thousands of parentheses can cause the Dovecot server to allocate approximately one megabyte of memory per connection. When an attacker sends multiple such commands without terminating the line, the memory allocated persists, potentially exhausting the server’s virtual address space. The result is the termination of the server process and disruption of all other proxied connections, constituting a denial-of-service condition.

The vulnerability affects Open-Xchange GmbH’s OX Dovecot Pro product. No version specifics are provided, so all releases of the affected product are considered at risk until a patched version is applied.

The severity indicated by the CVSS score of 4.3 reflects moderate risk, while the EPSS score of less than 1 % suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only network access to the Dovecot service and can be performed from a single IP address. By opening many connections and sending repeatedly constructed NOOP commands, an attacker can consume significant memory resources and trigger a crash, thereby lowering availability of the mail server.