| Name | CVE-2026-27852 |
| Description | An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, causing denial of service for the affected user. Update to non-vulnerable version. No publicly available exploits are known. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DSA-6526-1 |
| Debian Bugs | 1146018 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| dovecot (PTS) | bookworm, bookworm (security) | 1:2.3.19.1+dfsg1-2.1+deb12u6 | vulnerable |
| trixie | 1:2.4.1+dfsg1-6+deb13u6 | vulnerable | |
| trixie (security) | 1:2.4.1+dfsg1-6+deb13u7 | fixed | |
| forky | 1:2.4.5+dfsg1-2 | fixed | |
| sid | 1:2.4.5+dfsg1-3 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| dovecot | source | trixie | 1:2.4.1+dfsg1-6+deb13u7 | DSA-6526-1 | ||
| dovecot | source | (unstable) | 1:2.4.5+dfsg1-1 | 1146018 |
https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html#cve-2026-27852-dos-by-sending-mail-with-bad-header
Fixed by: https://github.com/dovecot/core/commit/035fbfa155288ac037965e0e4700eb198ccbf39a (2.4.3)
Fixed by: https://github.com/dovecot/core/commit/4380d7c5293760c0473566a227c63f3f91304f90
Fixed by: https://github.com/dovecot/core/commit/8f0089e5a811d7ee46eff17e2a46de7e004a74f4
Fixed by: https://github.com/dovecot/core/commit/ec0294808ea6443690044132c5f309ed0272cc06
Fixed by: https://github.com/dovecot/core/commit/977de721d6fcac09ab254958253856abcc0393c1
Fixed by: https://github.com/dovecot/core/commit/f27b7ae04f88f662c5f2bdd256ee9bef86d4c937
Fixed by: https://github.com/dovecot/core/commit/00daee1af18d929b3fcd14aa52840e38fe929711
Fixed by: https://github.com/dovecot/core/commit/41c4a77d2830a70616273962c720b7e2a9041efa
Fixed by: https://github.com/dovecot/core/commit/a81dd72a884a4f3e6b2859e9dd4fbada8c3900fe
Fixed by: https://github.com/dovecot/core/commit/84e6d207c83e9c1ed1d533d591475d9da2d6b55b
Fixed by: https://github.com/dovecot/core/commit/4b7e869b4b8fb70e0c32e4106aebc31a07b9f75b
Fixed by: https://github.com/dovecot/core/commit/c853685f820157046136bd027861cb2a21c13fbc
Fixed by: https://github.com/dovecot/core/commit/32010a7067a7970d302981c888f1e10904184499
Fixed by: https://github.com/dovecot/core/commit/1fa4c5a3fe21ca1994e54022050d23e260416c3c