CVE-2026-40014

A flaw was found in Dovecot. A remote attacker, by sending a specially crafted email message header to a user, can cause the Internet Message Access Protocol (IMAP) THREAD command to consume excessive CPU resources. When a mail client processes this message, it can lead to degradation or a denial of service for the IMAP server.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, administrators should monitor Dovecot processes for abnormal CPU usage. If high CPU consumption is observed, identify and terminate the offending Dovecot process. Subsequently, remove the malicious email from the affected mailbox to prevent re-triggering the vulnerability. Restarting the Dovecot service may be required after process termination, which could temporarily impact mail service availability.