| Name | CVE-2026-73209 |
| Description | An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits are known. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DSA-6526-1 |
| Debian Bugs | 1146018 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| dovecot (PTS) | bookworm, bookworm (security) | 1:2.3.19.1+dfsg1-2.1+deb12u6 | vulnerable |
| trixie | 1:2.4.1+dfsg1-6+deb13u6 | vulnerable | |
| trixie (security) | 1:2.4.1+dfsg1-6+deb13u7 | fixed | |
| forky | 1:2.4.5+dfsg1-2 | fixed | |
| sid | 1:2.4.5+dfsg1-3 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| dovecot | source | trixie | 1:2.4.1+dfsg1-6+deb13u7 | DSA-6526-1 | ||
| dovecot | source | (unstable) | 1:2.4.5+dfsg1-1 | 1146018 |
https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html#cve-2026-73209-imap-login-crash-self-recursion-on-zero-output-decompress-chunks
Fixed by: https://github.com/dovecot/core/commit/d0559b33adf1470547b6ee6ea7a82903296c5f69
Fixed by: https://github.com/dovecot/core/commit/1567b9f98db64d9a90c24925f19b48cfd59a0f1b
Fixed by: https://github.com/dovecot/core/commit/86aba25a1159f7ff11480feec287647be78054d1
Fixed by: https://github.com/dovecot/core/commit/f269b3d3051044aec31cef888fcf4c9ddd21c227
Fixed by: https://github.com/dovecot/core/commit/cac140a9e4e12485bde4348b8a8c94a7a96a6e5e
Fixed by: https://github.com/dovecot/core/commit/09df3b5b8b970439ab6b1b617b344a21cb2c07fe
Fixed by: https://github.com/dovecot/core/commit/351a30e80ce690fcefd458624a6c14c3aa514dca
Fixed by: https://github.com/dovecot/core/commit/e9eb23933949f8cbdd13282071169dc89876c139
Fixed by: https://github.com/dovecot/core/commit/f740e63144970ee36d3ca6d38e52b81d405c6f67