Description

An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. No publicly available exploits are known.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-28T12:16:27.990Z",
  "pubdate": "2026-08-28T12:16:27.990Z",
  "executiveSummary": "This vulnerability involves a resource exhaustion flaw within the IMAP protocol implementation, specifically triggered by the LIST command. An attacker possessing valid user credentials can leverage this command to induce excessive CPU consumption on the target mail server.\nThe vulnerability manifests as a Denial of Service (DoS) condition, potentially leading to service degradation or complete unavailability for legitimate users. Because the flaw relates to the processing of IMAP commands, the attack surface is exposed to any authenticated user with network access to the IMAP service.\nThe primary risk implication is the disruption of email infrastructure and service availability. Successful exploitation does not require administrative privileges, merely valid credentials. No publicly known exploits currently exist for this vulnerability; however, the simplicity of the attack vector necessitates prompt attention to resource management and system hardening.\nMitigation strategies focus on applying vendor-supplied patches, monitoring system performance metrics for anomalous CPU spikes associated with authenticated sessions, and implementing automated account security measures to neutralize malicious actors.",
  "technicalDetails": "The vulnerability resides within the request parsing and processing logic of the IMAP server component responsible for handling the LIST command. The IMAP LIST command is designed to return a subset of names from the complete set of all names available to the client, effectively listing mailboxes.\nThe root cause of this vulnerability is an inefficiency in how the server parses or executes the LIST command when subjected to specific, crafted input from an authenticated client. Instead of efficiently traversing the mailbox hierarchy, the internal logic enters an intensive computational state. This behavior suggests a lack of proper resource constraints, recursion depth limits, or inefficient algorithmic complexity (e.g., O(n) or higher) during the mailbox matching or lookup process.\nThe attack flow follows a structured pattern: 1) The attacker authenticates to the IMAP service using valid credentials. 2) The attacker issues a sequence of malformed or specifically crafted IMAP LIST commands designed to trigger the identified computational inefficiency. 3) The server attempts to process these requests, resulting in the underlying process consuming disproportionate CPU resources. 4) As the attacker continues to inject these commands, the cumulative load on the CPU increases, leading to thread or process saturation.\nThe impact of this exploitation is a resource-exhaustion-based Denial of Service. Because IMAP servers often operate on a per-connection or per-process basis, an attacker can effectively starve other legitimate user sessions of CPU cycles, resulting in high latency, connection timeouts, and service degradation. In scenarios where resource limits are not strictly enforced on a per-user or per-process basis, the entire IMAP daemon may become unresponsive, requiring manual intervention to restore service.\nThe vulnerability is limited to the IMAP protocol implementation and requires the attacker to be authenticated, meaning it is not a pre-authentication vulnerability. However, because valid credentials are required, an attacker with compromised accounts can easily achieve persistence in their denial-of-service attempts. The attack is carried out over the standard network protocols utilized by IMAP (e.g., TCP port 143 or 993). Post-exploitation, the server remains vulnerable to continued degradation unless the offending session is terminated and the associated account is restricted."
}