CVE-2026-52687

A flaw was found in dovecot. A remote attacker with valid credentials can exploit this vulnerability by selecting a compression algorithm for the IMAP connection that requires a large amount of memory for decompression. By opening several such connections, the attacker can exhaust the process's memory limit, leading to the termination of the process and all its connections. This can cause degradation or a complete denial of service for IMAP.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, disable IMAP compression in the Dovecot configuration. This can be achieved by ensuring that zlib or other compression plugins are not loaded for IMAP services. For example, remove zlib from the mail_plugins setting in dovecot.conf or a relevant configuration file. A restart of the Dovecot service is required for the changes to take effect. Disabling compression may result in increased network bandwidth usage for IMAP connections.