CVE-2026-33606: Improper Neutralization of CRLF Sequences ('CRLF Injection') in Open-Xchange GmbH OX Dovecot Pro

This vulnerability involves improper neutralization of CRLF sequences (CRLF injection) in OX Dovecot Pro. Specifically, mail content stored by a user can be crafted so that when an administrator runs dsync with the stream protocol, the content is interpreted as dsync commands. This can modify mailbox state and internal attributes that users should not control, potentially causing dsync errors. The vulnerability affects versions 2.3.0, 3.0.0, and 3.1.0 of OX Dovecot Pro. There is no known public exploit, and no official remediation level or patch information is provided.

An attacker with the ability to store crafted mail content can influence mailbox state during migration or replication processes by injecting commands via the dsync stream protocol. This can lead to unauthorized changes to mailbox attributes and cause errors in dsync operations. The confidentiality of mailbox data is not impacted, but integrity is affected. Availability impact is not indicated.

Avoid running dsync with the stream protocol on mailboxes containing untrusted content. Users should update to a non-vulnerable version of OX Dovecot Pro once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.