CVE-2026-52687
Received Received - Intake

Memory Exhaustion in Open-Xchange IMAP Service

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: Open-Xchange

Description
An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections. The memory limit of the process is reached with only a few connections, terminating the process and all connections it handles, which can cause degradation or denial of service for IMAP. Disable IMAP compression. Alternatively limit the number of connections handled by a single imap-login process, though this has a performance impact. Update to non-vulnerable version. No publicly available exploits are known.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-28
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-52687
EUVD
EUVD-2026-67679

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an attacker with valid credentials to exploit IMAP compression by selecting an algorithm that consumes excessive memory. Opening multiple such connections exhausts the process memory, causing the service to terminate and disrupting all active IMAP connections.

Detection Guidance

Monitor IMAP service memory usage and connection counts. Check for processes exceeding normal memory limits or sudden drops in IMAP service availability. No specific commands are provided in the context.

Impact Analysis

The attack can degrade or completely deny IMAP service for users, leading to interrupted email access. It may also cause system instability if the IMAP process crashes repeatedly.

Mitigation Strategies

Disable IMAP compression immediately. Alternatively, limit the number of connections per imap-login process. Update to a non-vulnerable version as soon as possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52687. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart