A critical denial of service vulnerability in Open-Xchange OX Dovecot Pro and CE allows unauthenticated attackers to crash IMAP processes via maliciously crafted email headers.

The software contains a vulnerability categorized as CWE-400, specifically uncontrolled resource consumption, where the IMAP parser fails to properly handle messages containing an excessive number of email addresses or MIME parameters, leading to process termination. This attack is unauthenticated and can be triggered remotely by any sender capable of delivering mail to the target server.

The successful exploitation of this vulnerability results in a denial of service for affected users, rendering their mailboxes unreachable via IMAP. Given the high CVSS score of 7.5, this flaw represents a significant threat to operational continuity, as an attacker could disrupt critical communication channels or impact service availability for entire user groups with minimal effort.

Immediate Action: Upgrade to the latest secure version of OX Dovecot Pro or CE as specified in the official vendor advisory to resolve the memory exhaustion flaw.

Proactive Monitoring: Review IMAP server logs for repeated process crashes or anomalous memory usage patterns that may indicate attempts to trigger this denial of service.

Compensating Controls: Implement strict email filtering and size limits on incoming messages at the gateway level to prevent malformed or overly large headers from reaching the Dovecot service.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing affected versions of OX Dovecot must prioritize the vendor-provided patches to ensure system stability. Because this vulnerability is automatable and requires no authentication, the risk of exploitation is elevated for internet-facing mail servers. Apply the recommended updates immediately to prevent potential service downtime.