A high-severity resource exhaustion vulnerability in Open-Xchange OX Dovecot allows unauthenticated attackers to cause a denial of service for IMAP authentication services.

The software suffers from uncontrolled resource consumption (CWE-400), where an unauthenticated attacker can submit a crafted IMAP ID command with excessive parameters. This forces the application to consume disproportionate memory and CPU, leading to process termination and a denial of service for all concurrent connections handled by that process.

The vulnerability carries a CVSS score of 7.5, reflecting a high risk due to the ease of exploitation by an unauthenticated attacker. Successful exploitation can disrupt email access for all users serviced by the affected IMAP process, leading to significant operational downtime and potential loss of productivity for organizations relying on this mail server.

Immediate Action: Update to the non-vulnerable versions provided by the vendor (OX Dovecot Pro 2.3.22.2, 3.0.7, 3.1.6, or OX Dovecot CE 2.4.5 or later).

Proactive Monitoring: Monitor system logs for repeated or unusually large IMAP ID command patterns and track memory usage spikes associated with the imap-login process.

Compensating Controls: As a temporary measure, limit the number of connections handled by a single imap-login process, although this may result in a minor performance degradation.

Public Exploit Available: Unknown

Given the ease of remote exploitation and the critical nature of mail services, organizations should prioritize patching their OX Dovecot installations immediately. If patching is not immediately feasible, administrators should implement the recommended connection limits to reduce the impact of potential resource exhaustion attempts while planning for the required software update.