CVE-2026-40017 in Dovecot Pro
Summary
by MITRE • 08/28/2026
An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that fix. Whenever a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage, kill the offending process and remove the offending message from the affected mailbox. Update to non-vulnerable version. No publicly available exploits are known.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability described involves a hash collision attack targeting the internal hash table used by an Internet Message Access Protocol server during the execution of the THREAD command. This specific flaw allows an attacker who has the ability to send email messages to a targeted user to craft message headers with values specifically designed to collide within this data structure. When such maliciously crafted headers are processed, the underlying algorithmic complexity degrades significantly from its expected linear or logarithmic performance characteristics to quadratic time complexity due to the excessive number of collisions that must be resolved by the hash table implementation. This results in the IMAP server consuming CPU resources disproportionately relative to the actual size of the message being processed.
This issue is distinct from CVE-2026-40014 and remains unaddressed by any fixes applied for that separate vulnerability, indicating a different code path or data structure handling mechanism within the mail server software. The operational impact centers on resource exhaustion leading to service degradation or complete denial of service for IMAP functionality. When an email client issues a THREAD command against a mailbox containing these crafted messages, the server becomes unresponsive or severely slowed down as it attempts to resolve the hash collisions required to organize and display message threads. This effectively blocks legitimate users from accessing their mailboxes via IMAP until the offending process is terminated or the malicious content is removed.
From a classification perspective, this vulnerability aligns with CWE-400, which covers Uncontrolled Resource Consumption, specifically manifesting as a Denial of Service through algorithmic complexity attacks often referred to as hash flooding or collision-based DoS. In terms of adversary tactics, this technique corresponds to ATT&CK T1496, Resourced Limited Computational Resources, where an attacker intentionally consumes computational resources to disrupt service availability for legitimate users. The attack vector requires the ability to send mail to a user, which may imply that authentication is not strictly required or that the sender has valid credentials in some configurations, highlighting potential weaknesses in input validation and message acceptance policies.
Mitigation strategies involve both immediate incident response actions and long-term remediation steps. Administrators should monitor system metrics for abnormal spikes in CPU usage associated with IMAP processes, which can serve as an early indicator of such an attack in progress. Upon detection, the offending process must be killed to restore service availability immediately. Following this, the specific malicious message causing the hash collision needs to be identified and removed from the affected mailbox to prevent recurrence upon subsequent THREAD commands. The definitive solution is to update the mail server software to a version that patches this vulnerability, ensuring that input validation for header fields is strengthened or alternative data structures resistant to hash collisions are employed. Currently, there are no publicly available exploits known for this specific issue, suggesting it may be an internal finding or recently disclosed flaw without widespread weaponization in the wild.