CVE-2026-127141
SOGo before 5.12.13 Denial of Service via Auxiliary IMAP Account Greeting Wait
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
SOGo before 5.12.13 contains a denial of service vulnerability that allows authenticated attackers to exhaust all worker processes by configuring an auxiliary IMAP mail account pointing to a controlled host that accepts a TCP connection but never sends an IMAP greeting response. Attackers can issue concurrent GET requests to the mail view of this account to hold workers indefinitely without an effective timeout, occupying every SOGo worker and denying service to all users for approximately five minutes until the watchdog kills and respawns the stuck workers.
| CWE | CWE-1088 |
| Vendor | alinto |
| Product | sogo |
| Published | Nov 12, 2026 |
| Last Updated | Nov 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for alinto sogo
Be the first to know when new medium vulnerabilities affecting alinto sogo are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
Alinto / sogo
0 < 5.12.13
References
Credits
Richard Olszynský