CVE-2026-27857 — Uncontrolled Resource Consumption in Gmbh OX Dovecot PRO

CWE-400 — Uncontrolled Resource ConsumptionCWE-770 — Allocation of Resources Without Limits or Throttling18 documents7 sources
Severity
4.3MEDIUMNVD
OSV5.3
EPSS
0.0%
top 86.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
DovecotDebian DovecotOpen-xchange Gmbh OX Dovecot PRO
Timeline
PublishedMar 27
Latest updateMar 31

Description

Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection. This 1 MB can be left allocated for longer time periods by not sending the command ending LF. So attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the process and its other proxied connections. Attacker could connect possibly…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LExploitability: 2.8 | Impact: 1.4

Affected Packages4 packages

▶debiandebian/dovecot< dovecot 1:2.3.19.1+dfsg1-2.1+deb12u2 (bookworm)
▶Debiandovecot/dovecot< 1:2.3.19.1+dfsg1-2.1+deb12u2+1
▶Ubuntudovecot/dovecot< 1:2.3.16+dfsg1-3ubuntu2.7+2

🔴Vulnerability Details

3
OSV
dovecot vulnerabilities↗2026-03-31
▶
GHSA
GHSA-j26c-8p6m-gpfj: Sending "NOOP (((↗2026-03-27
▶
OSV
CVE-2026-27857: Sending "NOOP (((↗2026-03-27
▶

📋Vendor Advisories

3
Ubuntu
Dovecot vulnerabilities↗2026-03-31
▶
Red Hat
dovecot: denial of service via specially crafted NOOP command↗2026-03-27
▶
Debian
CVE-2026-27857: dovecot - Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1M...↗2026
▶

🕵️Threat Intelligence

11
Wiz
CVE-2026-27858 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-0394 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-27856 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-27855 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2025-59032 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶