CVE-2026-33263: Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak') in Open-Xchange GmbH OX Dovecot Pro

This vulnerability occurs when the mail_max_userip_connections setting (default 10) is reached, causing the submission-login process to crash with an epoll() panic related to file descriptor handling. In high-security mode (default for community releases), only the new submission connection is terminated, whereas in high-performance mode (default for Pro releases), all connections handled by the submission-login process are terminated. Crashes can lead to failure in sending messages or duplicate message delivery if TLS is not used in backend processing. Limiting the number of connections per submission-login process can mitigate the issue but impacts performance. Updating to a non-vulnerable version is recommended. No public exploits are known.

The vulnerability can cause denial of service for message submission by crashing the submission-login process. In high-performance mode, all submission-login connections may be terminated, potentially disrupting multiple users. Duplicate message delivery can occur if TLS is not used in backend processing. There is no impact on confidentiality or integrity. The CVSS score is 4.3 (medium severity), reflecting limited impact primarily on availability.

Update to a non-vulnerable version of OX Dovecot Pro when available. Until then, limit the number of connections handled by a single submission-login process to reduce the risk of crashes, acknowledging this may impact performance. No official patch or remediation level is currently confirmed. Monitor vendor advisories for updates.