CVE-2026-40015
An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermittently cause an out-of-bounds read an…
Published: 2026-08-28 · CVSS: 4.3 · CVSS 3.1
An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermittently cause an out-of-bounds read and crash the process. The crash interrupts hibernated IMAP sessions handled by the affected process, which can cause degradation of service for IMAP. Disable IMAP hibernation. Update to non-vulnerable version. No publicly available exploits are known.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7