CyberRota Analysis
AI-GeneratedIMAP servers with compression enabled are vulnerable to an information disclosure attack, where an attacker can infer the content of small messages based on the size of responses during a session. While the risk is low and no exploits are currently available, organizations that handle sensitive information via email should prioritize disabling IMAP compression and updating to secure versions to mitigate potential risks. This vulnerability is particularly relevant for email service providers and enterprises managing sensitive communications.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail and other mail in the same mailbox. An attacker that can send mail to a user and can also observe the sizes of that user's IMAP traffic can confirm whether the body of a small message matches a guessed text. Recovery of arbitrary unknown content was not demonstrated, but the attack can disclose whether a secret-like message body matches a candidate. Disable IMAP compression. Update to non-vulnerable version. No publicly available exploits are known.