CVE-2026-42391

A flaw was found in Dovecot. An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in. This action causes the server to consume excessive memory and CPU resources, leading to the termination of login processes and other active connections. This can result in a degradation or complete denial of service for IMAP logins.

Red Hat has rated this issue as having an Important severity because unauthenticated remote attackers can induce a widespread denial of service against the mail daemon without prior privileges. Dovecot instances deployed in enterprise environments commonly expose IMAP listeners directly to public or untrusted networks to serve client mail traffic. By sending malformed identification requests, an external attacker can force excessive memory consumption that triggers process termination, abruptly dropping concurrent user sessions and preventing legitimate access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, limit the number of connections handled by a single imap-login process by adjusting the process_limit setting within the service imap-login block in your Dovecot configuration (e.g., /etc/dovecot/dovecot.conf). Increasing process_limit will cause Dovecot to spawn more imap-login processes, distributing connections more widely and reducing the impact of a single malicious connection.

For example, to set the process limit to 200:

# /etc/dovecot/dovecot.conf
service imap-login {
  process_limit = 200
}

After modifying the configuration, restart the Dovecot service for the changes to take effect. This may impact performance due to increased process overhead.

systemctl restart dovecot