---
id: "CVE-2026-127141"
page: "https://infrastack.ai/live/CVE-2026-127141"
kind: "vulnerability"
aliases: ["CVE-2026-127141"]
title: "SOGo: IMAP greeting hang lets authenticated users exhaust all workers"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["groupware", "package", "self-hosted", "sogo"]
not_affected_if: ["fixed-version", "no-auxiliary-imap"]
published_at: "2026-11-12T16:19:08+00:00"
first_seen_at: "2026-11-12T16:44:02+00:00"
updated_at: "2026-11-12T16:45:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127141", "first_seen_at": "2026-11-12T16:44:02+00:00"}]
exploit_sources: []
---

# SOGo: IMAP greeting hang lets authenticated users exhaust all workers

Link for people: https://infrastack.ai/live/CVE-2026-127141 (this .md is for agents)

SOGo before 5.12.13 lets a logged-in user configure an auxiliary IMAP account pointing at a host that accepts a connection but never sends a greeting. Concurrent mail-view requests then hold every SOGo worker, denying service to all users until the watchdog restarts them.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SOGo version against `5.12.13`
- Check whether users can add auxiliary IMAP accounts in SOGo preferences

## Fix

- SOGo: move to `5.12.13` or later

## Timeline

- 2026-11-12T16:44:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127141

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/sogo-before-denial-of-service-via-auxiliary-imap-account-greeting-wait
- [fix] Release notes: github.com https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13

## From the sources

SOGo before 5.12.13 contains a denial of service vulnerability that allows authenticated attackers to exhaust all worker processes by configuring an auxiliary IMAP mail account pointing to a controlled host that accepts a TCP connection but never sends an IMAP greeting response. Attackers can issue concurrent GET requests to the mail view of this account to hold workers indefinitely without an effective timeout, occupying every SOGo worker and denying service to all users for approximately five minutes until the watchdog kills and respawns the stuck workers.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_