7.5
CVE-2026-42006
- EPSS 0.45%
- Veröffentlicht 12.05.2026 13:28:46
- Zuletzt bearbeitet 30.06.2026 03:19:29
- Quelle security@open-xchange.com
- CVE-Watchlists
- Unerledigt
LoginAn attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit. Using excessive bracing, attacker can cause memory usage up to configured memory limit. Install fixed version, or configure vsz_limit for imap process to low value. No publicly available exploits are known.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Open-xchange ≫ Dovecot SwEditionpro Version < 3.1.5
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.45% | 0.361 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security@open-xchange.com | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
|
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
CWE-400 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
CWE-770 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json
https://access.redhat.com/security/cve/CVE-2026-42006
https://bugzilla.redhat.com/show_bug.cgi?id=2476476
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42006.json