CVE-2026-40017

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1

Description An attacker can send a crafted email with message header values designed to collide in an internal hash table. This causes the IMAP THREAD command to consume CPU resources disproportionate to the message size. When a mail client executes the THREAD command on the affected mailbox, it can lead to performance degradation or a denial of service for the IMAP service.

Recommendations Update to version 2.4.5-1.1. Monitor the system for abnormal CPU usage, terminate the offending process, and remove the malicious message from the affected mailbox.