Excessive CPU Consumption Vulnerability in Dovecot Email Server
Summary
CVE-2024-23184: Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. Affects dovecot versions < 2.3.21.1-r0. Fixed in 2.3.21.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dovecot is an open-source IMAP and POP3 email server for Unix-like operating systems, designed to provide secure and efficient email retrieval. It is widely used for its performance and flexibility, supporting various authentication mechanisms and mail storage formats. However, Dovecot is vulnerable to a significant issue where processing a large number of address headers can lead to excessive CPU usage, impacting server performance and availability.
Vulnerability Detail
The vulnerability, identified as CVE-2024-23184, arises from the handling of email address headers such as From, To, Cc, and Bcc. When an email contains an excessive number of these headers, it becomes CPU intensive to parse them. Testing revealed that processing 100,000 header lines resulted in 12 seconds of CPU time, while 500,000 headers took up to 18 minutes. This vulnerability can be exploited by external attackers who send specially crafted emails, leading to resource exhaustion and potential outages in the target system.
How To Fix
Minimum fixed version
2.3.21.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade dovecotTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, implement restrictions on the number of address headers processed by the Mail Transfer Agent (MTA) component preceding Dovecot. This can help limit the impact of potential attacks until a proper fix is applied.
Conclusion
CVE-2024-23184 presents a serious risk to Dovecot users, as it can lead to significant CPU resource consumption and potential outages. It is crucial to apply the recommended updates and consider temporary workarounds to mitigate the risk until the updates can be implemented.
See every vulnerability recorded for dovecot →
FAQ
CVE-2024-23184 is a vulnerability in Dovecot that allows excessive CPU consumption when processing a large number of email address headers.
An attacker can exploit this vulnerability by sending emails with a large number of address headers, leading to resource exhaustion on the target server.
The affected versions include Dovecot in Debian 11, 12, and 13 prior to the specified fixed versions.
If an immediate update is not possible, consider implementing restrictions on address headers in your MTA as a temporary workaround.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for dovecot.
