---
id: CVE-2026-42006
title: >-
  An attacker can cause uncontrolled memory usage with excessive bracing over
  IMAP
summary: >-
  An attacker can cause uncontrolled memory usage with excessive bracing over
  IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing
  this, so there was still another way left open. In particular, the fix was for
  clo…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-400
  - CWE-770
vendor: dovecot
product: dovecot
affected:
  - dovecot < 2.4.4
  - dovecot < 3.1.5
patched:
  - dovecot 3.1.5
published: '2026-05-12'
updated: '2026-07-10'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42006'
references:
  - url: >-
      https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json
    label: security@open-xchange.com
  - url: 'https://access.redhat.com/security/cve/CVE-2026-42006'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2476476'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42006.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
tags:
  - nvd
epss: 0.00621
epssPercentile: 0.4843
ingestedAt: '2026-07-10T14:03:54.821Z'
---

## Overview

An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit. Using excessive bracing, attacker can cause memory usage up to configured memory limit. Install fixed version, or configure vsz_limit for imap process to low value. No publicly available exploits are known.

## Affected

- `dovecot < 2.4.4`
- `dovecot < 3.1.5`

## Remediation

Upgrade past the affected range:

- `dovecot 3.1.5`