CVE-2026-33607

MediumCVSS 4.3/10Last modified Sep 3, 2026

Description

An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. No publicly available exploits are known.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published
Aug 28, 2026
Last modified
Sep 3, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-336089.8An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update CVE-2026-336096.5Incomplete escaping of LDAP queries when running with 8bit-dns enabled allows users to perform queries of internal domain subtrees.CVE-2026-33616.4The WP Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpsl_address' post meta value in versions upCVE-2026-336107.5A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondary server forwards a CVE-2026-336114.9An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cCVE-2026-336127.5A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to cache poisoning.CVE-2026-336138.8Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulnerability in the geneCVE-2026-336147.5An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo endpoint due to improper neutraCVE-2026-336159.1An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutraCVE-2026-336167.5An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb24api endpoint due to improper CVE-2026-336175.3An unauthenticated remote attacker can access a configuration file containing database credentials. This can result in a some loss of confidCVE-2026-336188.8Chamilo LMS is a learning management system. Prior to .0.0-RC.3, the PlatformConfigurationController::decodeSettingArray() method uses PHP's