{"id":"CVE-2026-127141","kind":"vulnerability","aliases":["CVE-2026-127141"],"related":[],"title":"SOGo: IMAP greeting hang lets authenticated users exhaust all workers","description":"SOGo before 5.12.13 contains a denial of service vulnerability that allows authenticated attackers to exhaust all worker processes by configuring an auxiliary IMAP mail account pointing to a controlled host that accepts a TCP connection but never sends an IMAP greeting response. Attackers can issue concurrent GET requests to the mail view of this account to hold workers indefinitely without an effective timeout, occupying every SOGo worker and denying service to all users for approximately five minutes until the watchdog kills and respawns the stuck workers.","summary":"SOGo before 5.12.13 lets a logged-in user configure an auxiliary IMAP account pointing at a host that accepts a connection but never sends a greeting. Concurrent mail-view requests then hold every SOGo worker, denying service to all users until the watchdog restarts them.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["groupware","package","self-hosted","sogo"],"not_affected_if":["fixed-version","no-auxiliary-imap"],"how_to_check":"- Check the installed SOGo version against `5.12.13`\n- Check whether users can add auxiliary IMAP accounts in SOGo preferences","fix":"- SOGo: move to `5.12.13` or later","status":"open","published_at":"2026-11-12T16:19:08+00:00","first_seen_at":"2026-11-12T16:44:02+00:00","triaged_at":"2026-11-12T16:45:40+00:00","updated_at":"2026-11-12T16:45:40+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T16:45:40Z","model":"claude-haiku-5-5","output":{"fix":"- SOGo: move to `5.12.13` or later","reach":"network","title":"SOGo: IMAP greeting hang lets authenticated users exhaust all workers","impact":"medium","summary":"SOGo before 5.12.13 lets a logged-in user configure an auxiliary IMAP account pointing at a host that accepts a connection but never sends a greeting. Concurrent mail-view requests then hold every SOGo worker, denying service to all users until the watchdog restarts them.","audience":"businesses","category":"package","nicknames":[],"who_cares":["sogo","self-hosted","groupware"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"all SOGo workers hang, denying service to every user","analyst_note":"","how_to_check":"- Check the installed SOGo version against `5.12.13`\n- Check whether users can add auxiliary IMAP accounts in SOGo preferences\n- unknown for other configuration details","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","no-auxiliary-imap"],"who_is_affected":"SOGo deployments before 5.12.13 where users can configure auxiliary IMAP mail accounts. An attacker needs a normal user account, and the worker pool is shared, so one account can take down service for everyone. Installations that disallow auxiliary IMAP accounts or run a fixed version can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00074,"input_tokens":4670,"output_tokens":545,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-127141':13A,16A '-2026':12A,15A '5.12.13':25B,71C 'accept':42B,100C 'account':36B,93C,123C 'allow':79C 'approxim':143C 'attack':81C,111C 'authent':6A,80C 'auxiliari':34B,90C 'concurr':50B,114C 'configur':32B,88C 'connect':44B,103C 'contain':72C 'control':97C 'cve':11A,14A 'deni':60B,137C 'denial':74C 'effect':130C 'everi':57B,133C 'exhaust':8A,83C 'five':144C 'get':115C 'greet':3A,49B,109C 'groupwar':17B 'hang':4A 'hold':56B,125C 'host':21B,40B,98C 'imap':2A,35B,91C,108C 'indefinit':127C 'issu':113C 'kill':149C 'let':5A,26B 'log':29B 'logged-in':28B 'mail':52B,92C,119C 'mail-view':51B 'minut':145C 'never':46B,105C 'occupi':132C 'packag':18B 'point':37B,94C 'process':86C 'request':54B,116C 'respawn':151C 'respons':110C 'restart':68B 'self':20B 'self-host':19B 'send':47B,106C 'servic':61B,76C,138C 'sogo':1A,22B,23B,58B,69C,134C 'stuck':153C 'tcp':102C 'timeout':131C 'user':7A,31B,64B,141C 'view':53B,120C 'vulner':77C 'watchdog':67B,148C 'without':128C 'worker':10A,59B,85C,126C,135C,154C","nicknames":[],"mitigations":[],"who_affected":"SOGo deployments before 5.12.13 where users can configure auxiliary IMAP mail accounts. An attacker needs a normal user account, and the worker pool is shared, so one account can take down service for everyone. Installations that disallow auxiliary IMAP accounts or run a fixed version can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["groupware","high","package","selfhosted","sogo"],"campaign_type":null,"search_a":"'-127141':13A,16A '-2026':12A,15A 'authent':6A 'cve':11A,14A 'exhaust':8A 'greet':3A 'hang':4A 'imap':2A 'let':5A 'sogo':1A 'user':7A 'worker':10A","search_b":"'5.12.13':25B 'accept':42B 'account':36B 'auxiliari':34B 'concurr':50B 'configur':32B 'connect':44B 'deni':60B 'everi':57B 'greet':49B 'groupwar':17B 'hold':56B 'host':21B,40B 'imap':35B 'let':26B 'log':29B 'logged-in':28B 'mail':52B 'mail-view':51B 'never':46B 'packag':18B 'point':37B 'request':54B 'restart':68B 'self':20B 'self-host':19B 'send':47B 'servic':61B 'sogo':22B,23B,58B 'user':31B,64B 'view':53B 'watchdog':67B 'worker':59B","search_c":"'5.12.13':71C 'accept':100C 'account':93C,123C 'allow':79C 'approxim':143C 'attack':81C,111C 'authent':80C 'auxiliari':90C 'concurr':114C 'configur':88C 'connect':103C 'contain':72C 'control':97C 'deni':137C 'denial':74C 'effect':130C 'everi':133C 'exhaust':83C 'five':144C 'get':115C 'greet':109C 'hold':125C 'host':98C 'imap':91C,108C 'indefinit':127C 'issu':113C 'kill':149C 'mail':92C,119C 'minut':145C 'never':105C 'occupi':132C 'point':94C 'process':86C 'request':116C 'respawn':151C 'respons':110C 'send':106C 'servic':76C,138C 'sogo':69C,134C 'stuck':153C 'tcp':102C 'timeout':131C 'user':141C 'view':120C 'vulner':77C 'watchdog':148C 'without':128C 'worker':85C,126C,135C,154C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T16:19:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127141","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127141","severity":null,"published_at":"2026-11-12T16:19:08+00:00","modified_at":"2026-11-12T16:19:08+00:00","first_seen_at":"2026-11-12T16:44:02+00:00","fetched_at":"2026-11-12T16:44:02+00:00","note":null}],"documents":[{"id":136541,"url":"https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":136550,"url":"https://www.vulncheck.com/advisories/sogo-before-denial-of-service-via-auxiliary-imap-account-greeting-wait","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}