CVE-2026-42391

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1

Description An unauthenticated attacker can send an IMAP ID command containing an excessive number of parameters before authentication. This action causes disproportionate growth in memory and CPU usage, potentially triggering out-of-memory handling that terminates the login process and all other connections managed by the same process, leading to service degradation or a denial of service for IMAP logins.

Recommendations Update to version 2.4.5-1.1. Limit the number of connections handled by a single imap-login process to mitigate the risk.