CVE-2026-33604: Insufficient Psychological Acceptability in Open-Xchange GmbH OX Dovecot Pro

This vulnerability involves insufficient psychological acceptability in OX Dovecot Pro where an attacker can relay a message (e.g., via Sieve redirect or submission relay) containing a crafted line ending in the message body. This crafted input bypasses outbound protections designed to prevent message content from being interpreted as SMTP commands. If the downstream mail server has not patched the SMTP smuggling vulnerability, it may treat part of the message body as new SMTP commands, allowing injection of spoofed emails. This vulnerability is related to CVE-2023-51764 and CVE-2023-51766, which are in the same class. The recommended mitigation includes updating to a fixed version and configuring receiving mail servers to reject bare carriage returns in message data.

The vulnerability allows an attacker to inject spoofed emails by exploiting SMTP smuggling on downstream mail servers that have not been fixed. This can lead to email spoofing and potentially undermine email trust and integrity. There is no impact on confidentiality or availability reported. No public exploits are known, reducing immediate risk.

Update OX Dovecot Pro to a non-vulnerable version as soon as available. Additionally, ensure that receiving mail servers reject bare carriage returns in message data to prevent exploitation of SMTP smuggling. Since no official patch links are provided, check vendor advisories for updates. No urgent action is required if receiving servers are already configured to reject bare carriage returns.