CVE-2026-73209CWE-674

CVE-2026-73209

Medium · published August 28, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
32.9
In the wild
Unconfirmed
What it is

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits are known.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00398 · 32.9th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-08-28T16:16Z
References (1)
https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json · [email protected]
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 28 AUG 10:12Z
    An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash
    cvelistv5