DEBIAN-CVE-2026-42006
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-42006
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-42006.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-42006
- Upstream
- Published
- 2026-05-12T14:17:04Z
- Modified
- 2026-09-14T17:03:11Z
- Severity
-
- 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
- Summary
- [none]
- Details
-
An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit. Using excessive bracing, attacker can cause memory usage up to configured memory limit. Install fixed version, or configure vsz_limit for imap process to low value. No publicly available exploits are known.
- References
Affected packages
Debian:12 / dovecot
Package
- Name
- dovecot
- Purl
- pkg:deb/debian/dovecot?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1:2.3.19.1+dfsg1-2.1+deb12u6
Debian:13 / dovecot
Package
- Name
- dovecot
- Purl
- pkg:deb/debian/dovecot?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1:2.4.1+dfsg1-6+deb13u6
Debian:14 / dovecot
Package
- Name
- dovecot
- Purl
- pkg:deb/debian/dovecot?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1:2.4.4+dfsg1-1