CVE-2026-27852

A flaw was found in dovecot. A remote attacker can craft a malicious email with an excessive number of email addresses or MIME parameters in its headers. When a user attempts to read this message over IMAP, the parsing process consumes an inordinate amount of memory, leading to the termination of the process. This can result in a denial of service for the affected user.

This vulnerability is rated as an Important severity flaw because an unauthenticated remote sender can deliver specially crafted messages that trigger denial of service conditions without requiring privileges on the mail server. In typical Red Hat Enterprise Linux deployments running Dovecot as an IMAP service, processing messages containing bloated header fields exhausts process memory limits during user retrieval sessions, abruptly terminating worker processes. While process isolation confines crashes to individual user sessions and prevents broader host compromise, repeated delivery can persistently disrupt mailbox availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.