CVE-2026-42391

Deferred Deferred - Pending Action

Memory Exhaustion in Open-Xchange IMAP Service

Publication date: 2026-08-28

Last updated on: 2026-09-03

Assigner: Open-Xchange

Description

An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by the same process. This can cause degradation or denial of service for IMAP logins. Limit the number of connections handled by a single imap-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-03

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-42391

EUVD

EUVD-2026-67674

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability allows an unauthenticated attacker to send an IMAP ID command with an excessive number of parameters before logging in. This causes disproportionate memory and CPU usage, potentially leading to denial of service for IMAP logins by terminating the login process and other connections handled by the same process.

Detection Guidance

Monitor IMAP server logs for unusually high memory or CPU usage during login attempts. Check for IMAP ID commands with an excessive number of parameters. Use system monitoring tools like top, htop, or ps to observe resource consumption spikes during IMAP login processes.

Impact Analysis

It can degrade or completely deny IMAP login services, affecting email access for users. The out-of-memory handling may terminate all connections managed by the affected process, disrupting email server operations.

Compliance Impact

This vulnerability causes denial of service for IMAP logins by consuming excessive memory and CPU resources. While it does not directly impact data confidentiality or integrity, prolonged service disruption could interfere with access to personal data, potentially affecting compliance with GDPR's availability requirements or HIPAA's access controls.

Mitigation Strategies

Limit the number of connections handled by a single imap-login process to reduce impact. Update the IMAP server to a non-vulnerable version immediately. Implement rate limiting for IMAP login attempts to prevent resource exhaustion.

Hi! I’m here to help you understand CVE-2026-42391. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70