Description

An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by the same process. This can cause degradation or denial of service for IMAP logins. Limit the number of connections handled by a single imap-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T12:16:29.503Z",
  "pubdate": "2026-08-28T12:16:29.503Z",
  "executiveSummary": "An unauthenticated remote denial-of-service vulnerability exists within the IMAP server implementation concerning the processing of the IMAP ID command. The flaw resides in the inadequate handling of excessive parameters provided during the pre-authentication phase.\nAn attacker can exploit this by transmitting a crafted IMAP ID command containing an abnormally high number of parameters, triggering disproportionate memory and CPU consumption. This resource exhaustion eventually forces the process into an out-of-memory (OOM) state.\nBecause the vulnerability impacts the imap-login process, the resultant crash causes the termination of all concurrent client sessions managed by that specific process, leading to service degradation and potential denial of service.\nThe vulnerability is exploitable by unauthenticated users, requiring only network access to the IMAP service. No prior credentials are required to initiate the attack, making the service globally susceptible if exposed. While no public exploits are currently documented, the ease of triggerability poses a significant availability risk to the affected system.",
  "technicalDetails": "The vulnerability originates from the lack of input validation and resource limiting mechanisms within the IMAP ID command parser. When a client issues an ID command prior to authentication, the IMAP service attempts to process and store the provided parameters. If the number of parameters is excessively high, the memory allocation requirements for tracking these arguments grow disproportionately to the input size.\nThe attack flow begins when an unauthenticated attacker establishes a TCP connection to the IMAP service and initiates the IMAP login phase. Before authentication is completed, the attacker sends a malformed or intentionally bloated ID command. The server's logic fails to enforce an upper bound on the number of parameters, causing the application process to consume significant memory and CPU cycles as it attempts to parse and buffer the extensive parameter list.\nThe accumulation of memory pressure triggers the operating system's out-of-memory (OOM) killer or internal memory management exceptions. In the event of a crash or forced termination of the imap-login process, all active connections being handled by that specific process instance are abruptly terminated. This architecture creates a cross-user impact, where a single malicious connection can forcibly disconnect all legitimate users sharing that process context.\nThe vulnerable component is the imap-login process responsible for handling incoming connections before the authentication handshake is fully finalized. The lack of strict resource quotas for early-stage IMAP command processing serves as the root cause of the denial-of-service. This vulnerability is particularly dangerous as it occurs in the unauthenticated state, providing a wide attack surface for remote disruption. Exploitation does not require elevated privileges, and the impact is primarily service availability degradation rather than remote code execution."
}