CVE-2026-73209
Last modified
CVE-2026-73209 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. EPSS estimates a 0.32% chance of exploitation in the next 30 days.
Description
An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits are known.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Open-Xchange GmbH | OX Dovecot Pro | >= 2.3.0, < 2.3.22.2; >= 3.0.0, < 3.0.7; >= 3.1.0, < 3.1.6 |
| Open-Xchange GmbH | OX Dovecot CE | >= 2.3.0, < 2.4.5 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-73209?
How severe is CVE-2026-73209?
How do I fix CVE-2026-73209?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-73196A flaw was found in FreeIPA. A low-privilege authenticated u…6.5
- CVE-2026-73197A flaw was found in FreeIPA. A remote, unauthenticated attac…7.5
- CVE-2026-73198A flaw was found in FreeIPA. A remote, unauthenticated attac…7.5
- CVE-2026-73199A flaw was found in the `ipa-enrollment` SLAPI plugin. A rem…6.5
- CVE-2026-7320Information disclosure due to incorrect boundary conditions …7.5
- CVE-2026-73208An attacker that holds a token intended for a different purp…7.4
- CVE-2026-7321Sandbox escape due to incorrect boundary conditions in the W…9.6
- CVE-2026-73210A Server-Side Request Forgery (SSRF) vulnerability existed i…5.1
- CVE-2026-73211PeerTube is an ActivityPub-federated video streaming platfor…9.8
- CVE-2026-73212Coturn is a free open source implementation of TURN and STUN…5.8
- CVE-2026-73213Coturn is a free open source implementation of TURN and STUN…5.8
- CVE-2026-73214Coturn is a free open source implementation of TURN and STUN…8.2
Are you affected by CVE-2026-73209?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST