CVE-2026-42393: Exposure of Sensitive Information to an Unauthorized Actor in Open-Xchange GmbH OX Dovecot Pro

The vulnerability arises from a timing side-channel in the comparison function used for doveadm passwords and API keys in OX Dovecot Pro. Because the comparison is not fully timing safe, an attacker with network access to the doveadm service can perform repeated requests and measure response times to determine the length of the secret. While the secret value is not directly leaked, knowing its length can aid in guessing attacks. The vulnerability affects specific versions of OX Dovecot Pro and requires network-level access to the service.

An attacker on the same network as the doveadm service can infer the length of the password or API key by measuring response timing differences. This information reduces the complexity of guessing the secret but does not disclose the secret itself. There is no known public exploitation of this vulnerability, and the overall impact is limited to partial information disclosure with low severity.

Restrict network access to the doveadm service to trusted clients only to prevent unauthorized timing measurements. Update to a non-vulnerable version of OX Dovecot Pro when available. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.