Medium severity5.3NVD Advisory· Published Mar 27, 2026· Updated Apr 30, 2026

CVE-2026-27859

Description

A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU. A suitably formatted mail message causes mail delivery process to consume large amounts of CPU time. Use MTA capabilities to limit RFC 2231 MIME parameters in mail messages, or upgrade to fixed version where the processing is limited. No publicly available exploits are known.

Affected products

Dovecot (software)/Dovecot2 versions
cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*range: <2.4.3
- (no CPE)
Open-Xchange/Dovecot
cpe:2.3:a:open-xchange:dovecot:*:*:*:*:pro:*:*:*
Range: <3.0.5
osv-coords4 versions
pkg:rpm/opensuse/dovecot24&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/dovecot24&distro=openSUSE%20Tumbleweed pkg:rpm/suse/dovecot24&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/dovecot24&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0
< 2.4.3-160000.1.1+ 3 more
- (no CPE)range: < 2.4.3-160000.1.1
- (no CPE)range: < 2.4.3-1.1
- (no CPE)range: < 2.4.3-160000.1.1
- (no CPE)range: < 2.4.3-160000.1.1

Patches

Vulnerability mechanics

References

documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.jsonnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000