CVE-2026-27852
published 2026-08-28CVE-2026-27852: An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.43%
36.2th percentile
An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, causing denial of service for the affected user. Update to non-vulnerable version. No publicly available exploits are known.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dovecot | dovecot | — | — |
| open-xchange_gmbh | ox_dovecot_ce | >= 2.3.0 < 2.4.5 | 2.4.5 |
| open-xchange_gmbh | ox_dovecot_pro | >= 2.3.0 < 2.3.22.2 | 2.3.22.2 |
| open-xchange_gmbh | ox_dovecot_pro | >= 3.0.0 < 3.0.7 | 3.0.7 |
| open-xchange_gmbh | ox_dovecot_pro | >= 3.1.0 < 3.1.6 | 3.1.6 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
dovecot: Dovecot: Denial of service via crafted email headers
vendor_redhat·2026-08-28·CVSS 7.5
CVE-2026-27852 [HIGH] CWE-770 dovecot: Dovecot: Denial of service via crafted email headers
dovecot: Dovecot: Denial of service via crafted email headers
An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, causing denial of service for the affected user. Update to non-vulnerable version. No publicly available exploits are known.
A flaw was found in dovecot. A remote attacker can craft a malicious email with an excessive number of email addresses or MIME parameters in its headers. When a user attempts to read this message over IMAP, the parsing process consumes an inordinate amount of memory, leading to t
GHSA
An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is la
ghsa_unreviewed·2026-08-28
CVE-2026-27852 [HIGH] CWE-400 An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is la
An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, causing denial of service for the affected user. Update to non-vulnerable version. No publicly available exploits are known.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-27852 dovecot: Dovecot: Denial of service via crafted email headers [fedora-all]
bugzilla·2026-09-01·CVSS 7.5
CVE-2026-27852 [HIGH] CVE-2026-27852 dovecot: Dovecot: Denial of service via crafted email headers [fedora-all]
CVE-2026-27852 dovecot: Dovecot: Denial of service via crafted email headers [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, causing denial of service for the affected user. Update to non-vulnerable version. No publicly available exploits are known.
Bugzilla
CVE-2026-27852 perl-Email-Address-XS: Dovecot: Denial of service via crafted email headers [fedora-all]
bugzilla·2026-09-01·CVSS 7.5
CVE-2026-27852 [HIGH] CVE-2026-27852 perl-Email-Address-XS: Dovecot: Denial of service via crafted email headers [fedora-all]
CVE-2026-27852 perl-Email-Address-XS: Dovecot: Denial of service via crafted email headers [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, causing denial of service for the affected user. Update to non-vulnerable version. No publicly available exploits are known.
Bugzilla
CVE-2026-27852 perl-Email-Address-XS: Dovecot: Denial of service via crafted email headers [epel-all]
bugzilla·2026-09-01·CVSS 7.5
CVE-2026-27852 [HIGH] CVE-2026-27852 perl-Email-Address-XS: Dovecot: Denial of service via crafted email headers [epel-all]
CVE-2026-27852 perl-Email-Address-XS: Dovecot: Denial of service via crafted email headers [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, causing denial of service for the affected user. Update to non-vulnerable version. No publicly available exploits are known.
Bugzilla
CVE-2026-27852 dovecot: Dovecot: Denial of service via crafted email headers
bugzilla·2026-08-28·CVSS 7.5
CVE-2026-27852 [HIGH] CVE-2026-27852 dovecot: Dovecot: Denial of service via crafted email headers
CVE-2026-27852 dovecot: Dovecot: Denial of service via crafted email headers
An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, causing denial of service for the affected user. Update to non-vulnerable version. No publicly available exploits are known.
2026-08-28
Published