Description

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that fix. Whenever a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage, kill the offending process and remove the offending message from the affected mailbox. Update to non-vulnerable version. No publicly available exploits are known.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-28T12:16:28.480Z",
  "pubdate": "2026-08-28T12:16:28.480Z",
  "executiveSummary": "This vulnerability involves an algorithmic complexity denial-of-service (DoS) condition triggered by specifically crafted mail headers that cause hash table collisions within the IMAP THREAD command implementation.\nBy manipulating mail header values to induce worst-case computational complexity during hash map insertion or lookup, an unauthenticated remote attacker can force the server to consume disproportionate CPU resources.\nThe vulnerability affects IMAP server implementations utilizing vulnerable hash table structures for processing message threading.\nSuccessful exploitation results in service degradation or a complete denial-of-service for the IMAP service, as the CPU-intensive processing blocks other operations.\nThis issue is distinct from CVE-2026-40014 and remains unaddressed by previous patches.\nNo publicly available exploits exist, but the attack requires the ability to deliver email to the targeted mailbox, making it a remotely exploitable vulnerability against mail-processing infrastructure.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the internal hash table used by the IMAP THREAD command to organize and group messages.\nThe IMAP THREAD command processes message metadata, specifically header values, to build a hierarchical view of email conversations. If the underlying hash table implementation lacks robust collision resistance or utilizes a predictable hash function, it becomes susceptible to algorithmic complexity attacks.\nAn attacker can exploit this by crafting a series of email headers whose contents, when hashed, produce identical or near-identical indices within the hash table (hash collisions). When the THREAD command is subsequently executed by a user or an automated client, the server must traverse long linked lists or re-hash these entries, causing the insertion and lookup operations to degrade from O(1) average time complexity to O(n) or worse.\nThe attack flow follows these steps: 1) The attacker identifies the target mail server's hashing behavior. 2) The attacker transmits an email to the victim containing a header value intentionally engineered to collide with existing entries in the mailbox's metadata hash table. 3) The target client or mailbox indexer triggers the IMAP THREAD command. 4) The server's CPU utilization spikes significantly as it struggles to resolve the hash collisions during the THREAD operation. 5) Prolonged or repeated execution of this process leads to service starvation, effectively causing a denial-of-service for the IMAP service.\nThis is a resource exhaustion vulnerability that occurs within the IMAP server process. Because the processing occurs at the server level, it does not require user interaction to trigger, only that the malicious mail exists in the mailbox when the THREAD command is invoked. As the vulnerability is independent of CVE-2026-40014, legacy patches that focus on other aspects of IMAP command handling do not mitigate this specific algorithmic attack vector.\nThe impact is significant, as it allows a remote attacker to destabilize mail delivery infrastructure without requiring high-privilege access, simply by leveraging the standard IMAP protocol features."
}