The flaw allows an attacker to exploit excessive bracing in IMAP commands to cause uncontrolled memory consumption. The previous patch addressed only one direction of brace closing, leaving a path via open braces that bypasses the limit. An attacker can drive memory usage up to the configured limit, potentially exhausting system resources and disrupting service. The vulnerability is a classic resource exhaustion weakness (CWE‑400).

The vulnerability affects OX Dovecot Pro from Open-Xchange GmbH. No specific affected version range is listed in the CNA data, so all installed instances of OX Dovecot Pro prior to the vendor’s fix should be considered vulnerable.

The CVSS score of 4.3 indicates a moderate severity threat. Because the EPSS score is not available and the vulnerability is not listed in CISA KEV, it is not currently known to be actively exploited. The flaw can be triggered by sending IMAP commands with excessive bracing, which is feasible over any accessible IMAP server instance. An attacker can increase memory consumption up to the server’s configured limit, potentially leading to resource exhaustion and service disruption. The vulnerability was not found to have publicly available exploit code, so the primary risk comes from the possibility of repeated or targeted high‑volume IMAP traffic.