CVE-2026-73209
published 2026-08-28CVE-2026-73209: An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process…
PriorityP335medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.40%
32.9th percentile
An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits are known.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dovecot | dovecot | — | — |
| open-xchange_gmbh | ox_dovecot_ce | >= 2.3.0 < 2.4.5 | 2.4.5 |
| open-xchange_gmbh | ox_dovecot_pro | >= 2.3.0 < 2.3.22.2 | 2.3.22.2 |
| open-xchange_gmbh | ox_dovecot_pro | >= 3.0.0 < 3.0.7 | 3.0.7 |
| open-xchange_gmbh | ox_dovecot_pro | >= 3.1.0 < 3.1.6 | 3.1.6 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
dovecot: Dovecot: Denial of Service via crafted compressed data
vendor_redhat·2026-08-28·CVSS 6.5
CVE-2026-73209 [MEDIUM] CWE-770 dovecot: Dovecot: Denial of Service via crafted compressed data
dovecot: Dovecot: Denial of Service via crafted compressed data
An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits are known.
A flaw was found in Dovecot. An authenticated attacker can send specially crafted compressed data, leading to the affected process exhausting its stack and crashing. This termination of the process can result in degradation or a complete denial of service for the IMAP (Internet Message Access Protocol) service.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the
GHSA
An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash.
ghsa_unreviewed·2026-08-28
CVE-2026-73209 [MEDIUM] CWE-674 An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash.
An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits are known.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-73209 dovecot: Dovecot: Denial of Service via crafted compressed data [fedora-all]
bugzilla·2026-09-01·CVSS 6.5
CVE-2026-73209 [MEDIUM] CVE-2026-73209 dovecot: Dovecot: Denial of Service via crafted compressed data [fedora-all]
CVE-2026-73209 dovecot: Dovecot: Denial of Service via crafted compressed data [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits are known.
Bugzilla
CVE-2026-73209 dovecot: Dovecot: Denial of Service via crafted compressed data
bugzilla·2026-08-28·CVSS 6.5
CVE-2026-73209 [MEDIUM] CVE-2026-73209 dovecot: Dovecot: Denial of Service via crafted compressed data
CVE-2026-73209 dovecot: Dovecot: Denial of Service via crafted compressed data
An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits are known.
2026-08-28
Published