An attacker with the ability to send email to a target user can craft message headers that collide in an internal hash table. When the affected mail client issues an IMAP THREAD command on that mailbox, the server performs excessive CPU work that is disproportionate to the message size. This can degrade performance or lead to a denial of service for the IMAP service. The weakness stems from improper resource control in the handling of hash collisions, identified as CWE‑400, and inadequate memory allocation limits, identified as CWE‑770.

The issue affects the Open‑Xchange Dovecot CE and Pro releases. Users of Ou‑Xchange’s OX Dovecot that have not upgraded to a patched version are vulnerable. No specific version range is detailed in the advisory, so all current installations remain at risk until a non‑vulnerable release is applied.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of 0.00272 (less than 1%) suggests that the likelihood of exploitation is low, and coupled with the absence of publicly known exploits and its exclusion from the CISA KEV catalog, widespread exploitation appears unlikely at present. This weakness includes improper resource control (CWE‑400) and insufficient memory allocation limits (CWE‑770). Nonetheless, an attacker who can send mail to the target can still trigger the CPU drain by issuing a THREAD command, especially if the mailbox contains messages with the crafted colliding headers. The attack vector is likely the mail delivery path combined with IMAP command usage, requiring the attacker to control mail sent to the victim's mailbox.