Description
An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit. Using excessive bracing, attacker can cause memory usage up to configured memory limit. Install fixed version, or configure vsz_limit for imap process to low value. No publicly available exploits are known.
Affected products
dovecot: dovecot; open-xchange: dovecot
References10
- documentation.open-xchange.com/dovecot/security/advisories/csaf… Issue Tracking
- access.redhat.com/errata/RHSA-2026:41905
- access.redhat.com/errata/RHSA-2026:41988
- access.redhat.com/errata/RHSA-2026:42091
- access.redhat.com/errata/RHSA-2026:44355
- access.redhat.com/errata/RHSA-2026:44357
- access.redhat.com/errata/RHSA-2026:44373
- access.redhat.com/errata/RHSA-2026:46379
- access.redhat.com/errata/RHSA-2026:46380
- access.redhat.com/errata/RHSA-2026:46381
Metrics
- CVSS 3.1
-
4.3
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - EPSS — exploit probability
- 1% percentile: 50 · as of 14 November 2026
- CWE
- CWE-400CWE-770
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.