CVE-2026-40203

A flaw was found in dovecot where, when IMAP compression is enabled, the system reuses the same compression state across responses within a session. This allows a remote attacker, who can send mail to a user and monitor the sizes of their IMAP traffic, to potentially deduce the content of small messages. By observing response sizes, an attacker could confirm if a secret message body matches a guessed text, leading to information disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable IMAP compression in the Dovecot configuration. This typically involves setting imap_compression = no in the relevant Dovecot configuration file. After making this change, restart the Dovecot service for the mitigation to take effect. Restarting the service may temporarily interrupt IMAP access for users.