Detections
Analytics
CVE-2026-42006
high
Description
An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit. Using excessive bracing, attacker can cause memory usage up to configured memory limit. Install fixed version, or configure vsz_limit for imap process to low value. No publicly available exploits are known.
References
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42006.json
https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json
https://bugzilla.redhat.com/show_bug.cgi?id=2476476
https://access.redhat.com/security/cve/CVE-2026-42006
https://access.redhat.com/errata/RHSA-2026:49513
https://access.redhat.com/errata/RHSA-2026:46532
https://access.redhat.com/errata/RHSA-2026:46381
https://access.redhat.com/errata/RHSA-2026:46380
https://access.redhat.com/errata/RHSA-2026:46379
https://access.redhat.com/errata/RHSA-2026:44373
https://access.redhat.com/errata/RHSA-2026:44357
https://access.redhat.com/errata/RHSA-2026:44355
https://access.redhat.com/errata/RHSA-2026:42091