ZeroDay Findings
Sign inSign up

Findings

CVE-2026-42006

An attacker can cause uncontrolled memory usage with excessive bracing over IMAP.

Published May 12, 2026 · updated Aug 3, 2026 · dovecot dovecot

An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit. Using excessive bracing, attacker can cause memory usage up to configured memory limit. Install fixed version, or configure vsz_limit for imap process to low value. No publicly available exploits are known.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. May 12, 2026 · NIST NVD

    Detected

    An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit. Using excessive bracing, attacker can cause memory usage up to configured memory limit. Insta

  2. Aug 3, 2026 · NIST NVD

    Updated

    An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit. Using excessive bracing, attacker can cause memory usage up to configured memory limit. Insta

Affected

  • cpe dovecot/dovecotversion unspecified
  • cpe open-xchange/dovecotversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-42006

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-42006

    An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open b

    nvd.nist.gov

References

CVE-2026-42006 · ZeroDay Findings