CVE-2026-33607
published 2026-08-28CVE-2026-33607: An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for…
PriorityP423medium4.3CVSS 3.1
AVNACLPRLUINSUCNINAL
EPSS
0.55%
45.5th percentile
An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. No publicly available exploits are known.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dovecot | dovecot | — | — |
| open-xchange_gmbh | ox_dovecot_ce | >= 2.3.0 < 2.4.5 | 2.4.5 |
| open-xchange_gmbh | ox_dovecot_pro | >= 2.3.0 < 3.0.7 | 3.0.7 |
| open-xchange_gmbh | ox_dovecot_pro | >= 3.1.0 < 3.1.6 | 3.1.6 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
An attacker that has valid credentials can use IMAP LIST command to consume CPU.
ghsa_unreviewed·2026-08-28
CVE-2026-33607 [MEDIUM] CWE-400 An attacker that has valid credentials can use IMAP LIST command to consume CPU.
An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. No publicly available exploits are known.
Red Hat
dovecot: Dovecot: Denial of Service via IMAP LIST command
vendor_redhat·2026-08-28·CVSS 4.3
CVE-2026-33607 [MEDIUM] CWE-606 dovecot: Dovecot: Denial of Service via IMAP LIST command
dovecot: Dovecot: Denial of Service via IMAP LIST command
An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. No publicly available exploits are known.
A flaw was found in Dovecot. An authenticated attacker can exploit a vulnerability in the IMAP LIST command to consume excessive CPU resources. This can lead to a degradation of service or a complete denial of service (DoS) for the IMAP server, impacting the availability of email services.
Mitigation: To mitigate this issue, restrict access to the Dovecot IMAP service to trusted networks or localhost using firewall rules or Doveco
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-33607 dovecot: Dovecot: Denial of Service via IMAP LIST command [fedora-all]
bugzilla·2026-09-01·CVSS 4.3
CVE-2026-33607 [MEDIUM] CVE-2026-33607 dovecot: Dovecot: Denial of Service via IMAP LIST command [fedora-all]
CVE-2026-33607 dovecot: Dovecot: Denial of Service via IMAP LIST command [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. No publicly available exploits are known.
Bugzilla
CVE-2026-33607 dovecot: Dovecot: Denial of Service via IMAP LIST command
bugzilla·2026-08-28·CVSS 4.3
CVE-2026-33607 [MEDIUM] CVE-2026-33607 dovecot: Dovecot: Denial of Service via IMAP LIST command
CVE-2026-33607 dovecot: Dovecot: Denial of Service via IMAP LIST command
An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. No publicly available exploits are known.
2026-08-28
Published