CVE-2026-40017

A flaw was found in Dovecot. A remote attacker who can send mail to a user can craft a message header designed to cause collisions in an internal hash table. This manipulation forces the IMAP THREAD command to consume excessive CPU resources, leading to degradation or a complete denial of service for the IMAP server. This can disrupt email services for affected users.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, administrators should identify and remove the specially crafted IMAP message from the affected user's mailbox. If a Dovecot process is consuming excessive CPU resources due to this vulnerability, it should be terminated to restore service. Note that terminating a process will temporarily interrupt service for affected users.