CVE-2026-52687

Name	CVE-2026-52687
Description	An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections. The memory limit of the process is reached with only a few connections, terminating the process and all connections it handles, which can cause degradation or denial of service for IMAP. Disable IMAP compression. Alternatively limit the number of connections handled by a single imap-login process, though this has a performance impact. Update to non-vulnerable version. No publicly available exploits are known.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-6526-1
Debian Bugs	1146018

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
dovecot (PTS)	bookworm, bookworm (security)	1:2.3.19.1+dfsg1-2.1+deb12u6	vulnerable
	trixie	1:2.4.1+dfsg1-6+deb13u6	vulnerable
	trixie (security)	1:2.4.1+dfsg1-6+deb13u7	fixed
	forky	1:2.4.5+dfsg1-2	fixed
	sid	1:2.4.5+dfsg1-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
dovecot	source	trixie	1:2.4.1+dfsg1-6+deb13u7		DSA-6526-1
dovecot	source	(unstable)	1:2.4.5+dfsg1-1			1146018

Notes

https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html#cve-2026-52687-imap-compress-zstd-can-cause-excessive-memory-usage
Fixed by: https://github.com/dovecot/core/commit/65293cc0a6bc74f730b9ff036ec1e6456e671f88
Fixed by: https://github.com/dovecot/core/commit/e58c15ba1486a055462f7a2853a4b6a954e0eafa
Fixed by: https://github.com/dovecot/core/commit/b020b257c45d48c623db54909df4d3ae9b0975a1