CVE-2020-7046

Vulnerability

The vulnerability resides in lib-smtp within Dovecot's submission-login and lmtp components. Due to improper handling of truncated UTF-8 data in command parameters, a crafted input can cause an infinite loop, consuming 100% CPU. This affects Dovecot core version 2.3.9; the issue is fixed in version 2.3.9.3 [1][2].

Exploitation

An unauthenticated attacker can trigger the vulnerability by sending a specially crafted, truncated UTF-8 sequence as part of an SMTP command to the submission-login or LMTP service. No authentication or prior access is required; the attacker only needs network reachability to the affected services. The malformed input causes the lib-smtp parser to enter an infinite loop, locking the process [1][2].

Impact

Successful exploitation results in a denial of service (DoS) condition. The affected submission-login or lmtp process becomes unresponsive and consumes 100% CPU, effectively exhausting system resources and preventing legitimate mail submission or delivery. There is no impact on confidentiality or integrity; the CVSS score is 7.5 (High) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [1][2].

Mitigation

Upgrade to Dovecot 2.3.9.3, released on or around February 12, 2020, which contains the fix for CVE-2020-7046 [1][2]. No workarounds have been published for systems that cannot immediately upgrade. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.