CVE-2026-52687
published 2026-08-28CVE-2026-52687: An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory…
PriorityP335medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.40%
32.9th percentile
An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections. The memory limit of the process is reached with only a few connections, terminating the process and all connections it handles, which can cause degradation or denial of service for IMAP. Disable IMAP compression. Alternatively limit the number of connections handled by a single imap-login process, though this has a performance impact. Update to non-vulnerable version. No publicly available exploits are known.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dovecot | dovecot | — | — |
| open-xchange_gmbh | ox_dovecot_ce | >= 2.3.11 < 2.4.5 | 2.4.5 |
| open-xchange_gmbh | ox_dovecot_pro | >= 2.3.11 < 2.3.22.2 | 2.3.22.2 |
| open-xchange_gmbh | ox_dovecot_pro | >= 3.0.0 < 3.0.7 | 3.0.7 |
| open-xchange_gmbh | ox_dovecot_pro | >= 3.1.0 < 3.1.6 | 3.1.6 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections.
ghsa_unreviewed·2026-08-28
CVE-2026-52687 [MEDIUM] CWE-400 An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections.
An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections. The memory limit of the process is reached with only a few connections, terminating the process and all connections it handles, which can cause degradation or denial of service for IMAP. Disable IMAP compression. Alternatively limit the number of connections handled by a single imap-login process, though this has a performance impact. Update to non-vulnerable version. No publicly available exploits are known.
Red Hat
dovecot: dovecot: Denial of Service via IMAP compression memory exhaustion
vendor_redhat·2026-08-28·CVSS 6.5
CVE-2026-52687 [MEDIUM] CWE-770 dovecot: dovecot: Denial of Service via IMAP compression memory exhaustion
dovecot: dovecot: Denial of Service via IMAP compression memory exhaustion
An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections. The memory limit of the process is reached with only a few connections, terminating the process and all connections it handles, which can cause degradation or denial of service for IMAP. Disable IMAP compression. Alternatively limit the number of connections handled by a single imap-login process, though this has a performance impact. Update to non-vulnerable version. No publicly available exploits are known.
A flaw was found in dovecot. A remote attacker with valid credentials can exploit this vulnerability by selecting a
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-52687 dovecot: dovecot: Denial of Service via IMAP compression memory exhaustion [fedora-all]
bugzilla·2026-09-01·CVSS 6.5
CVE-2026-52687 [MEDIUM] CVE-2026-52687 dovecot: dovecot: Denial of Service via IMAP compression memory exhaustion [fedora-all]
CVE-2026-52687 dovecot: dovecot: Denial of Service via IMAP compression memory exhaustion [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections. The memory limit of the process is reached with only a few connections, terminating the process and all connections it handles, which can cause degradation or denial of service for IMAP. Disable IMAP compression. Alternatively limit the number of connections handled by a singl
Bugzilla
CVE-2026-52687 dovecot: dovecot: Denial of Service via IMAP compression memory exhaustion
bugzilla·2026-08-28·CVSS 6.5
CVE-2026-52687 [MEDIUM] CVE-2026-52687 dovecot: dovecot: Denial of Service via IMAP compression memory exhaustion
CVE-2026-52687 dovecot: dovecot: Denial of Service via IMAP compression memory exhaustion
An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections. The memory limit of the process is reached with only a few connections, terminating the process and all connections it handles, which can cause degradation or denial of service for IMAP. Disable IMAP compression. Alternatively limit the number of connections handled by a single imap-login process, though this has a performance impact. Update to non-vulnerable version. No publicly available exploits are known.
2026-08-28
Published