CVE-2026-42006
Full vulnerability record from the local CVENow database.
Description
An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit. Using excessive bracing, attacker can cause memory usage up to configured memory limit. Install fixed version, or configure vsz_limit for imap process to low value. No publicly available exploits are known.
Severity
MEDIUM
CVSS score
4.3
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2026-05-12 14:17:04.703000
Last modified
2026-10-26 18:10:00.173000
View original CVE JSON
{
"id": "CVE-2026-42006",
"sourceIdentifier": "[email protected]",
"published": "2026-05-12T14:17:04.703",
"lastModified": "2026-10-26T18:10:00.173",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit. Using excessive bracing, attacker can cause memory usage up to configured memory limit. Install fixed version, or configure vsz_limit for imap process to low value. No publicly available exploits are known."
},
{
"lang": "es",
"value": "Un atacante puede causar un uso descontrolado de memoria con un uso excesivo de llaves a través de IMAP. La solución en CVE-2026-27857 fue incompleta, solo bloqueando una forma de hacer esto, por lo que aún quedaba otra forma abierta. En particular, la solución era para llaves de cierre, pero aún se podían usar llaves de apertura para eludir el límite. Usando un uso excesivo de llaves, el atacante puede causar un uso de memoria hasta el límite de memoria configurado. Instale la versión corregida, o configure vsz_limit para el proceso imap a un valor bajo. No se conocen exploits disponibles públicamente."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Open-Xchange GmbH",
"product": "OX Dovecot Pro",
"defaultStatus": "unaffected",
"modules": [
"core"
],
"versions": [
{
"version": "0",
"lessThanOrEqual": "3.0.5",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThanOrEqual": "3.1.4",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThanOrEqual": "2.4.3",
"versionType": "semver",
"status": "affected"
}
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"versions": [
{
"version": "1:2.3.21-19.el10_2.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"versions": [
{
"version": "1:2.3.21-16.el10_0.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"versions": [
{
"version": "1:2.2.36-8.el7_9.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"versions": [
{
"version": "1:2.3.16-8.el8_10",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4"
],
"versions": [
{
"version": "1:2.3.8-9.el8_4.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/a:redhat:rhel_eus_long_life:8.4"
],
"versions": [
{
"version": "1:2.3.8-9.el8_4.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6"
],
"versions": [
{
"version": "1:2.3.16-2.el8_6.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/a:redhat:rhel_eus_long_life:8.6"
],
"versions": [
{
"version": "1:2.3.16-2.el8_6.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/a:redhat:rhel_tus:8.8"
],
"versions": [
{
"version": "1:2.3.16-3.el8_8.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8"
],
"versions": [
{
"version": "1:2.3.16-3.el8_8.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"versions": [
{
"version": "1:2.3.16-18.el9_8.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"versions": [
{
"version": "1:2.3.16-8.el9_2.3",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4"
],
"versions": [
{
"version": "1:2.3.16-11.el9_4.3",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"versions": [
{
"version": "1:2.3.16-15.el9_6.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"defaultStatus": "unknown",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dovecot",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-12T15:40:29.845540Z",
"id": "CVE-2026-42006",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-400"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-770"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.4.4",
"matchCriteriaId": "86CE1F3B-DF73-431A-9EC0-491E8969A187"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:open-xchange:dovecot:*:*:*:*:pro:*:*:*",
"versionEndExcluding": "3.1.5",
"matchCriteriaId": "28C2DD58-A4B0-4F2C-BC60-F30F380251BC"
}
]
}
]
}
],
"references": [
{
"url": "https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json",
"source": "[email protected]",
"tags": [
"Issue Tracking"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:41905",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:41988",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:42091",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:44355",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:44357",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:44373",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:46379",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:46380",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:46381",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:46532",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:49513",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-42006",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476476",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42006.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
]
}