CVE-2026-27859
Excessive RFC 2231 MIME Parameters Cause LMTP High CPU Usage
Publication date: 2026-03-27
Last updated on: 2026-04-30
Assigner: Open-Xchange
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dovecot | dovecot | to 2.4.3 (exc) |
| open-xchange | dovecot | From 3.1.0 (inc) to 3.1.4 (exc) |
| open-xchange | dovecot | to 3.0.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
This vulnerability occurs when a mail message contains an excessive number of RFC 2231 MIME parameters. This causes the LMTP (Local Mail Transfer Protocol) process to consume an unusually large amount of CPU resources. Essentially, a specially crafted email can cause the mail delivery process to use excessive CPU time, potentially degrading system performance.
To mitigate this, it is recommended to use Mail Transfer Agent (MTA) capabilities to limit the number of RFC 2231 MIME parameters in mail messages or upgrade to a fixed version of the software where such processing is limited.
How can this vulnerability impact me? :
The primary impact of this vulnerability is a denial of service through resource exhaustion. A mail server processing a specially crafted email with excessive RFC 2231 MIME parameters may consume large amounts of CPU, potentially slowing down or disrupting mail delivery services.
This can lead to degraded performance of the mail server, increased latency in mail delivery, and possible interruption of mail services if CPU resources are heavily consumed.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves a mail message containing an excessive amount of RFC 2231 MIME parameters causing the LMTP mail delivery process to consume large amounts of CPU time.
Detection can be approached by monitoring the CPU usage of the mail delivery process (LMTP) for unusually high consumption when processing incoming mail messages.
Specific commands to detect this condition are not provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include using the mail transfer agent (MTA) capabilities to limit the number of RFC 2231 MIME parameters in mail messages.
Alternatively, upgrading to a fixed version of the software where processing of these parameters is limited is recommended.
No publicly available exploits are known, but limiting MIME parameters or upgrading reduces the risk of excessive CPU consumption.