| Name | CVE-2026-40017 |
| Description | An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that fix. Whenever a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage, kill the offending process and remove the offending message from the affected mailbox. Update to non-vulnerable version. No publicly available exploits are known. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DSA-6526-1 |
| Debian Bugs | 1146018 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| dovecot (PTS) | bookworm, bookworm (security) | 1:2.3.19.1+dfsg1-2.1+deb12u6 | vulnerable |
| trixie | 1:2.4.1+dfsg1-6+deb13u6 | vulnerable | |
| trixie (security) | 1:2.4.1+dfsg1-6+deb13u7 | fixed | |
| forky | 1:2.4.5+dfsg1-2 | fixed | |
| sid | 1:2.4.5+dfsg1-3 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| dovecot | source | trixie | 1:2.4.1+dfsg1-6+deb13u7 | DSA-6526-1 | ||
| dovecot | source | (unstable) | 1:2.4.5+dfsg1-1 | 1146018 |
https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html#cve-2026-40017-imap-thread-o-m3-cpu-dos-via-crc32-hash-collision-in-strmap-mail-index-strmap-c-hash2-c
Fixed by: https://github.com/dovecot/core/commit/d3e1c7fb5845f68d84aa04d941b8116048b06195
Fixed by: https://github.com/dovecot/core/commit/15689cf2cd9f078cb52187568fe7086ecf0a00b2
Fixed by: https://github.com/dovecot/core/commit/a028002fcf7d3571e043206229950fed5245b4fe
Fixed by: https://github.com/dovecot/core/commit/886c06d1c46eb162af29c3d4653df91c4da3ee8d
Fixed by: https://github.com/dovecot/core/commit/8d4ff69d4a40d1073946823cd0f7c1d937f51aee
Fixed by: https://github.com/dovecot/core/commit/ec847941fd1d958b03d5578060abd294b1dc3cf8
Fixed by: https://github.com/dovecot/core/commit/fed5164930daf472fbb759096037efd5e7ee8468
Fixed by: https://github.com/dovecot/core/commit/03bd8a3d2c2783ab3bb6ab79eab9a2fc3609a6a6
Fixed by: https://github.com/dovecot/core/commit/3612c5ed51acb43c8142713c64cad6cc4234d4d6
Fixed by: https://github.com/dovecot/core/commit/1a02e74b03cbd298ca4d863735650cc13304513b
Fixed by: https://github.com/dovecot/core/commit/4d886f42e4524ed4df27042e33546512f3fe20cf
Fixed by: https://github.com/dovecot/core/commit/8fedf386644e979f731854e53aa2e26d599776a5