Description

An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections. The memory limit of the process is reached with only a few connections, terminating the process and all connections it handles, which can cause degradation or denial of service for IMAP. Disable IMAP compression. Alternatively limit the number of connections handled by a single imap-login process, though this has a performance impact. Update to non-vulnerable version. No publicly available exploits are known.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-28T12:16:30.133Z",
  "pubdate": "2026-08-28T12:16:30.133Z",
  "executiveSummary": "This vulnerability involves a memory exhaustion condition within the IMAP protocol handling logic when specific compression algorithms are utilized. The flaw allows an authenticated attacker to trigger an out-of-memory state by initiating multiple concurrent connections that demand significant memory resources for decompression state management.\nSuccessful exploitation results in the termination of the imap-login process, leading to a denial-of-service (DoS) condition for all user sessions managed by that process. This vulnerability poses a risk to service availability, particularly in environments where IMAP services handle high volumes of concurrent connections.\nThe attack requires valid credentials to access the IMAP service, limiting the exploit surface to authenticated users. No publicly available exploit code is known at this time. Mitigation strategies include disabling IMAP compression or adjusting resource allocation for connection handling.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper management of memory allocated for decompression contexts when a client negotiates specific compression algorithms over an IMAP connection. When an attacker initiates an IMAP session, they can select a resource-intensive compression algorithm, forcing the server to allocate disproportionate amounts of RAM to maintain the decompression state for that specific connection.\nThe exploitation flow begins with an authenticated attacker establishing multiple concurrent IMAP sessions. For each session, the attacker negotiates the high-memory-overhead compression algorithm. Because the server-side imap-login process does not adequately constrain the memory footprint of these individual decompression states, the aggregate memory usage quickly hits the process-level memory limit or the system's available memory threshold.\nOnce the process exceeds its memory allocation limit, the operating system or the internal management logic forces the termination of the imap-login process. This crash is catastrophic for service availability, as it immediately drops all active connections handled by that process, resulting in a denial-of-service condition for all legitimate users connected to that specific instance. The impact is persistent as long as the attacker continues to open new sessions, effectively preventing the service from stabilizing.\nThe vulnerability resides within the IMAP protocol implementation responsible for handling compression negotiation and state allocation. It specifically affects systems that rely on multi-connection imap-login processes to handle incoming traffic. Because the attacker requires valid credentials, the attack vector is restricted to authenticated entities; however, this does not mitigate the potential for significant disruption in multi-tenant or large-scale email environments.\nPost-exploitation impact is limited to the denial of service; there is no documented evidence suggesting remote code execution or privilege escalation via this memory exhaustion vector. The vulnerability can be effectively mitigated by restricting the protocol's feature set or by tuning process-level constraints to prevent a small number of malicious connections from exhausting the memory quota of the entire login daemon."
}