Resource exhaustion in Open-Xchange Gmbh Ox Dovecot Pro
CVE-2024-23184
Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. With 100k header lines CPU usage is already 12 seconds, and in a production environment we observed 500k header lines taking 18 minutes to parse. Since this can be triggered by external actors sending emails to a victim, this is a security issue. An external attacker can send specially crafted messages that consume target system resources and cause outage. One can implement restrictions on address headers on MTA component preceding Dovecot. No publicly available exploits are known.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.0 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.008 (56.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 56th percentile — 56.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Open-Xchange Gmbh Ox Dovecot Pro — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2024-23184?
- CVE-2024-23184 is a medium-severity vulnerability in Open-Xchange Gmbh Ox Dovecot Pro, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 5.0/10. Published 2024-09-10.
- How severe is CVE-2024-23184?
- Medium severity. CVSS v3 base score is 5.0 out of 10.