Vulnerability record · CVE-2020-7046 · published 12 February 2020
CVE-2020-7046: Dovecot submission-login and lmtp infinite loop via truncated UTF-8
Dovecot · Dovecot
Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters within lib-smtp used by submission-login and lmtp. The flaw is an uncontrolled loop (CWE-835) that can be triggered without authentication, causing a denial of service. It matters because mail submission and LMTP delivery paths can be stalled by malformed input.
Description
lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityHigh CVSS availability impact, unauthenticated network reachability, and very high EPSS percentile make this a significant DoS risk despite no KEV listing.
What it is
Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters within lib-smtp used by submission-login and lmtp. The flaw is an uncontrolled loop (CWE-835) that can be triggered without authentication, causing a denial of service. It matters because mail submission and LMTP delivery paths can be stalled by malformed input.
Impact
An attacker can drive the affected process into an infinite loop, consuming CPU and blocking mail submission or LMTP delivery for legitimate users. The CVSS vector shows availability-only impact with no confidentiality or integrity loss.
Attack surface
Reachable over the network via SMTP/LMTP command parameters containing truncated UTF-8; the CVSS vector indicates no privileges and no user interaction are required. The description explicitly notes unauthenticated triggering of the submission-login infinite loop.
Exploitation
Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high at 0.513 (98.9th percentile), indicating elevated likelihood of attempted exploitation.
What to do
- Upgrade Dovecot to 2.3.9.3 or later, or apply the vendor fix referenced in the Dovecot security advisory.
- Update Fedora packages using the referenced package-announce advisories.
- Restrict network access to submission and LMTP ports to trusted clients where feasible.
- Monitor and rate-limit connections to submission-login and LMTP services to reduce DoS exposure.
Detection
- Watch for submission-login or lmtp processes pinned at high CPU with no corresponding mail flow.
- Alert on repeated malformed or truncated UTF-8 sequences in SMTP/LMTP command parameters in server logs.
- Monitor for connection bursts to submission and LMTP ports from single sources.
- Track service restarts or timeouts on submission-login and lmtp workers.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2020-7046 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-7046), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
