Описание
An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by the same process. This can cause degradation or denial of service for IMAP logins. Limit the number of connections handled by a single imap-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known.
A flaw was found in Dovecot. An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in. This action causes the server to consume excessive memory and CPU resources, leading to the termination of login processes and other active connections. This can result in a degradation or complete denial of service for IMAP logins.
Отчет
Red Hat has rated this issue as having an Important severity because unauthenticated remote attackers can induce a widespread denial of service against the mail daemon without prior privileges. Dovecot instances deployed in enterprise environments commonly expose IMAP listeners directly to public or untrusted networks to serve client mail traffic. By sending malformed identification requests, an external attacker can force excessive memory consumption that triggers process termination, abruptly dropping concurrent user sessions and preventing legitimate access.
Меры по смягчению последствий
To mitigate this issue, limit the number of connections handled by a single imap-login process by adjusting the process_limit setting within the service imap-login block in your Dovecot configuration (e.g., /etc/dovecot/dovecot.conf). Increasing process_limit will cause Dovecot to spawn more imap-login processes, distributing connections more widely and reducing the impact of a single malicious connection.
For example, to set the process limit to 200:
After modifying the configuration, restart the Dovecot service for the changes to take effect. This may impact performance due to increased process overhead.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | dovecot | Out of support scope | ||
| Red Hat Enterprise Linux 7 | dovecot | Affected | ||
| Red Hat Enterprise Linux 10 | dovecot | Fixed | RHSA-2026:79371 | 08.10.2026 |
| Red Hat Enterprise Linux 8 | dovecot | Fixed | RHSA-2026:76763 | 06.10.2026 |
| Red Hat Enterprise Linux 9 | dovecot | Fixed | RHSA-2026:80825 | 12.10.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by the same process. This can cause degradation or denial of service for IMAP logins. Limit the number of connections handled by a single imap-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known.
An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by the same process. This can cause degradation or denial of service for IMAP logins. Limit the number of connections handled by a single imap-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known.
An unauthenticated attacker can send an IMAP ID command with a very la ...
An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by the same process. This can cause degradation or denial of service for IMAP logins. Limit the number of connections handled by a single imap-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known.
EPSS
7.5 High
CVSS3