Description
An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermittently cause an out-of-bounds read and crash the process. The crash interrupts hibernated IMAP sessions handled by the affected process, which can cause degradation of service for IMAP. Disable IMAP hibernation. Update to non-vulnerable version. No publicly available exploits are known.
Published: 2026-08-28
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (service interruption)
Action: Update
AI Analysis

Impact

An attacker who has valid credentials can open a large number of connections to the imap-hibernate service and send malformed commands. This triggers an out-of-bounds read that crashes the process. The crash interrupts hibernated IMAP sessions and can degrade the availability of the IMAP service.

Affected Systems

The vulnerability affects Open‑Xchange Dovecot Community Edition and Open‑Xchange Dovecot Professional. No specific version information is provided.

Risk and Exploitability

The reported CVSS score of 4.3 indicates a moderate impact. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires valid credentials, and no publicly available exploits are known. Detection would rely on observing abnormal connection patterns and repeated crashes, but after a fix the risk is effectively mitigated.

Generated by OpenCVE AI on August 28, 2026 at 13:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest patched version of Open‑Xchange Dovecot that removes the crash path.
  • Disable the IMAP hibernation feature if a patch is not immediately available.
  • Monitor IMAP server logs for an unusual number of concurrent connections or repeated malformed commands, and consider limiting connection rates if necessary.

Generated by OpenCVE AI on August 28, 2026 at 13:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Open-xchange
Open-xchange ox Dovecot Ce
Open-xchange ox Dovecot Pro
Vendors & Products Open-xchange
Open-xchange ox Dovecot Ce
Open-xchange ox Dovecot Pro

Tue, 01 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Title Out‑Of‑Bounds Read in IMAP Hibernation Service Causes Crash dovecot: Dovecot: Denial of Service via malformed IMAP commands in imap-hibernate service
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 28 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 28 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
Title Out‑Of‑Bounds Read in IMAP Hibernation Service Causes Crash

Fri, 28 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
Description An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermittently cause an out-of-bounds read and crash the process. The crash interrupts hibernated IMAP sessions handled by the affected process, which can cause degradation of service for IMAP. Disable IMAP hibernation. Update to non-vulnerable version. No publicly available exploits are known.
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Open-xchange Ox Dovecot Ce Ox Dovecot Pro
cve-icon MITRE

Status: PUBLISHED

Assigner: OX

Published:

Updated: 2026-08-28T15:03:07.769Z

Reserved: 2026-04-08T09:59:59.342Z

Link: CVE-2026-40015

cve-icon Vulnrichment

Updated: 2026-08-28T15:03:01.149Z

cve-icon NVD

Status : Deferred

Published: 2026-08-28T12:16:28.363

Modified: 2026-09-03T18:13:44.643

Link: CVE-2026-40015

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-28T10:12:18Z

Links: CVE-2026-40015 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-01T14:17:53Z

Weaknesses