CVE-2026-33604: Insufficient Psychological Acceptability in Open-Xchange GmbH OX Dovecot Pro

The vulnerability arises when Dovecot relays a message, for example via Sieve redirect or submission relay, and an attacker includes a crafted line ending in the message body. This bypasses outbound protections designed to prevent message content from being interpreted as SMTP commands. Downstream mail servers vulnerable to SMTP smuggling can be tricked into treating part of the message body as new SMTP commands, allowing injection of spoofed email. This vulnerability is in the same class as CVE-2023-51764 and CVE-2023-51766. Mitigation includes rejecting bare carriage returns in message data on receiving mail servers and updating to fixed versions.

The vulnerability allows injection of spoofed emails by bypassing outbound protections and exploiting SMTP smuggling vulnerabilities in downstream mail servers. This can lead to email spoofing and potential abuse of mail infrastructure integrity. There is no impact on confidentiality or availability reported. No public exploits are known at this time.

Ensure that receiving mail servers reject bare carriage returns in message data to mitigate SMTP smuggling. Update OX Dovecot Pro to a non-vulnerable version once available. Since no official patch or remediation level is provided in the advisory, monitor vendor communications for updates. No immediate public exploits are known.