CVE-2026-40203: Exposure of Sensitive Information to an Unauthorized Actor in Open-Xchange GmbH OX Dovecot Pro

The vulnerability arises from reuse of the same IMAP compression state across responses, which leaks information about message content size correlations. An attacker capable of sending mail to a victim and observing the victim's IMAP traffic size can confirm whether a secret message body matches a guessed candidate text. This side-channel does not allow full content recovery but can confirm matches of small message bodies. The vulnerability affects specific versions of OX Dovecot Pro. No public exploits have been reported, and no official remediation level or patch link is provided in the data.

The impact is limited to information disclosure of whether a secret-like message body matches a guessed text, based on traffic size analysis. There is no impact on integrity or availability. The CVSS score is 3.7 (low), reflecting the limited confidentiality impact and the requirement for attacker capabilities (sending mail and observing traffic).

Disabling IMAP compression is recommended to mitigate this vulnerability. Additionally, updating to a non-vulnerable version of OX Dovecot Pro is advised when available. Since no official remediation level or patch is provided, users should monitor vendor advisories for updates. No public exploits are known, so immediate urgent action is not required beyond these mitigations.