Description

An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, causing denial of service for the affected user. Update to non-vulnerable version. No publicly available exploits are known.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T12:16:27.330Z",
  "pubdate": "2026-08-28T12:16:27.330Z",
  "executiveSummary": "A memory exhaustion vulnerability exists in the email processing subsystem of the affected mail server software. The vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending specifically crafted emails with excessive headers or MIME parameters.\nThe vulnerability type is categorized as resource exhaustion, where the uncontrolled allocation of memory during the parsing of malicious email structures leads to process termination.\nThis vulnerability impacts systems where the mail server parses incoming messages upon IMAP retrieval. An attacker requires only the ability to send mail to a target user; no special privileges or authentication are required to deliver the payload. The risk is high for service availability, as successful exploitation results in the crashing of the process handling the user's IMAP requests, rendering the mailbox inaccessible.\nThe primary impact is the interruption of mail services for the targeted user. No remote code execution is described, but the disruption of the communication channel represents a significant availability risk.",
  "technicalDetails": "The root cause of this vulnerability is improper handling of malformed or oversized MIME parameters and header fields during the message parsing phase within the IMAP server component.\nWhen a mail server receives an email, it stores the raw data. The vulnerability manifests when the IMAP server attempts to retrieve and process this message for a client. The parser fails to implement sufficient bounds checking or memory allocation limits when encountering header-heavy messages or MIME structures containing an excessively high number of attributes.\nThe attack flow proceeds as follows: First, an attacker crafts an email message featuring an abnormally large volume of email addresses (e.g., in the 'To', 'Cc', or 'Bcc' fields) or deeply nested/complex MIME parameters. Second, this message is delivered to the victim's mail store through standard SMTP protocols. Third, when the victim authenticates via IMAP to read their messages, the server initiates a parsing operation on the stored email object.\nDuring this parsing phase, the server attempts to dynamically allocate memory to accommodate the structure defined by the attacker's payload. Because the input size is not sanitized or constrained by the parser, the application enters a state of unbounded memory allocation. This triggers the operating system's OOM (Out-of-Memory) killer or results in an application-level memory exhaustion error, which forces the IMAP process to terminate.\nBecause the IMAP process is responsible for serving mailbox data, its termination prevents the user from accessing their email. Depending on the server architecture, this may lead to a cascading failure if the process is shared across multiple users or if the mail server fails to restart the process correctly. Exploitation does not require prior authentication, and the vulnerability exists in the message parsing logic rather than the authentication layer. There are no known public exploits for this specific vulnerability, and successful impact is limited to resource starvation and DoS conditions."
}