CVE-2026-27859
Received Received - Intake
Excessive RFC 2231 MIME Parameters Cause LMTP High CPU Usage

Publication date: 2026-03-27

Last updated on: 2026-04-30

Assigner: Open-Xchange

Description
A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU. A suitably formatted mail message causes mail delivery process to consume large amounts of CPU time. Use MTA capabilities to limit RFC 2231 MIME parameters in mail messages, or upgrade to fixed version where the processing is limited. No publicly available exploits are known.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-27
Last Modified
2026-04-30
Generated
2026-06-16
AI Q&A
2026-03-27
EPSS Evaluated
2026-06-15
NVD
CVE-2026-27859
EUVD
EUVD-2026-16571
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
dovecot dovecot to 2.4.3 (exc)
open-xchange dovecot From 3.1.0 (inc) to 3.1.4 (exc)
open-xchange dovecot to 3.0.5 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability occurs when a mail message contains an excessive number of RFC 2231 MIME parameters. This causes the LMTP (Local Mail Transfer Protocol) process to consume an unusually large amount of CPU resources. Essentially, a specially crafted email can cause the mail delivery process to use excessive CPU time, potentially degrading system performance.

To mitigate this, it is recommended to use Mail Transfer Agent (MTA) capabilities to limit the number of RFC 2231 MIME parameters in mail messages or upgrade to a fixed version of the software where such processing is limited.

Impact Analysis

The primary impact of this vulnerability is a denial of service through resource exhaustion. A mail server processing a specially crafted email with excessive RFC 2231 MIME parameters may consume large amounts of CPU, potentially slowing down or disrupting mail delivery services.

This can lead to degraded performance of the mail server, increased latency in mail delivery, and possible interruption of mail services if CPU resources are heavily consumed.

Detection Guidance

This vulnerability involves a mail message containing an excessive amount of RFC 2231 MIME parameters causing the LMTP mail delivery process to consume large amounts of CPU time.

Detection can be approached by monitoring the CPU usage of the mail delivery process (LMTP) for unusually high consumption when processing incoming mail messages.

Specific commands to detect this condition are not provided in the available information.

Mitigation Strategies

Immediate mitigation steps include using the mail transfer agent (MTA) capabilities to limit the number of RFC 2231 MIME parameters in mail messages.

Alternatively, upgrading to a fixed version of the software where processing of these parameters is limited is recommended.

No publicly available exploits are known, but limiting MIME parameters or upgrading reduces the risk of excessive CPU consumption.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-27859. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart