CVE-2026-40015

A flaw was found in Dovecot's imap-hibernate service. An authenticated attacker can open numerous connections and send malformed commands, leading to an out-of-bounds read. This can intermittently crash the process, interrupting hibernated IMAP sessions and causing a denial of service for affected users.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable IMAP hibernation in Dovecot. This can be achieved by setting imap_hibernate_timeout = 0 in the Dovecot configuration. For example, add or modify the following line in /etc/dovecot/local.conf or a relevant configuration file within /etc/dovecot/conf.d/:

imap_hibernate_timeout = 0

After modifying the configuration, restart the Dovecot service for the changes to take effect:

systemctl restart dovecot

Disabling IMAP hibernation may affect the performance or behavior of IMAP sessions that rely on this feature.