CVE-2026-27857 is a denial-of-service vulnerability where sending a specially crafted "NOOP" command with numerous parentheses causes excessive memory allocation, potentially leading to process termination. The specific affected products are not detailed in the provided information. Rated as medium severity (CVSS 4.3), this vulnerability is a low-complexity network attack requiring low privileges, primarily impacting availability by allowing an attacker to exhaust memory resources. There are no known public exploits, Metasploit modules, or Nuclei templates, and it is not listed on the CISA KEV catalog. Active exploitation has not been observed, and community discussion regarding this CVE is minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.4.3CPE matchmatch criteria | cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:* | ||
< 2.3.22.1CPE matchmatch criteria | cpe:2.3:a:open-xchange:dovecot:*:*:*:*:pro:*:*:* | ||
>= 3.0.0, < 3.0.5CPE matchmatch criteria | cpe:2.3:a:open-xchange:dovecot:*:*:*:*:pro:*:*:* | ||
>= 3.1.0, < 3.1.4CPE matchmatch criteria | cpe:2.3:a:open-xchange:dovecot:*:*:*:*:pro:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Dovecot vulnerabilities
Mar 31, 2026imap-login: Excessive memory usage DoS. Sending `NOOP (((...)))` command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection. This 1 MB can be left allocated for longer time periods by not sending the command ending LF. So attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the process and its other proxied connections.
Mar 27, 2026Dovecot vulnerabilities