CVE-2026-33606 is a medium severity vulnerability in Open-Xchange GmbH's OX Dovecot Pro that allows crafted mail content to be interpreted as dsync protocol commands during migration or replication using the stream protocol. This can lead to unauthorized modification of mailbox state and internal mailbox attributes. No public exploits are known. Users are advised to avoid running dsync with the stream protocol on mailboxes containing untrusted content and to update to a non-vulnerable version when available.
CVE-2026-33605 is a high-severity vulnerability in Open-Xchange GmbH's OX Dovecot Pro affecting ManageSieve login. An unauthenticated attacker can send a malformed command before authentication to crash the ManageSieve login process. In high-security mode (default for community releases), only the attacker's connection is terminated, but in high-performance mode (default for Pro releases), all connections handled by the same managesieve-login process are terminated. This can lead to denial of service for Sieve script management. No public exploits are known. Restricting network access to trusted clients and updating to a non-vulnerable version are recommended.
CVE-2026-33604 is a medium severity vulnerability in Open-Xchange GmbH OX Dovecot Pro that allows an attacker to bypass outbound message content protections by using crafted message lines ending in the body. This can trick downstream mail servers that have not fixed SMTP smuggling vulnerabilities into interpreting part of the message body as SMTP commands, enabling injection of spoofed emails. No public exploits are known. Users controlling receiving mail servers should ensure rejection of bare carriage returns in message data and update to a non-vulnerable version when available.
CVE-2026-33263 is a vulnerability in Open-Xchange GmbH OX Dovecot Pro where the submission-login process can crash due to file descriptor handling issues when the mail_max_userip_connections limit is reached. This can cause message sending failures or duplicate messages under certain conditions. The impact varies depending on the security mode configuration. No public exploits are known.
CVE-2026-27852 is a vulnerability in Open-Xchange GmbH's OX Dovecot Pro where an attacker can cause excessive memory usage by sending an email with headers containing a very large number of email addresses or MIME parameters. This leads to memory exhaustion and termination of the process when the message is read over IMAP, resulting in denial of service for the affected user. No public exploits are known. The vulnerability affects specific versions of the product.
An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit. Using excessive bracing, attacker can cause memory usage up to configured memory limit. Install fixed version, or configure vsz_limit for imap process to low value. No publicly available exploits are known.
Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be spammed to all users. The impact is limited to being able to spam folders to other users, no unexpected access is gained. Install to fixed version. No publicly available exploits are known.
Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the configured limit. Attacker can use this to degrade server performance and bypass configured CPU time limits for Sieve scripts. Install fixed version, or alternatively prevent direct access to Sieve scripts via ManageSieve or local access. No publicly available exploits are known.
Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to position itself between Dovecot and the client connection. If successful, the attacker can eavesdrop communications between Dovecot and client as MITM proxy. Install fixed version. No publicly available exploits are known.
When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.
CVE-2026-27860 is an LDAP injection vulnerability in Open-Xchange GmbH's OX Dovecot Pro. It occurs if the configuration parameter auth_username_chars is empty, allowing injection of arbitrary LDAP filters during LDAP authentication. This can potentially bypass restrictions and enable probing of the LDAP structure. No public exploits are known, and the vulnerability has a low severity rating with a CVSS score of 3.7.
CVE-2026-27859 is a medium severity vulnerability in Open-Xchange GmbH's OX Dovecot Pro mail server. It involves uncontrolled resource consumption where a mail message with an excessive number of RFC 2231 MIME parameters causes the LMTP mail delivery process to consume excessive CPU resources. This can degrade mail server performance but does not impact confidentiality or integrity. No public exploits are known. Mitigation involves using MTA capabilities to limit RFC 2231 MIME parameters or upgrading to a fixed version that limits processing. Patch status is not confirmed from the available data.
Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory.
Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.
Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection. This 1 MB can be left allocated for longer time periods by not sending the command ending LF. So attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the process and its other proxied connections. Attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the process and its other proxied connections. Install fixed version, there is no other remediation. No publicly available exploits are known.
Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured credentials. Figuring out the credential will lead into full access to the affected component. Limit access to the doveadm http service port, install fixed version. No publicly available exploits are known.
CVE-2026-27855 is a medium severity vulnerability in Open-Xchange GmbH's OX Dovecot Pro affecting its OTP authentication mechanism. Under specific conditions—when authentication cache is enabled and the username is altered in the password database—OTP credentials can be cached, allowing replay of the same OTP response. An attacker who can observe an OTP exchange may reuse it to log in as the user. The vulnerability is mitigated by using secure communication protocols such as SCRAM or OAUTH2 or by securing the communication channel. No public exploits are known at this time.
Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.
CVE-2026-0394 is a medium severity path traversal vulnerability in Open-Xchange GmbH's OX Dovecot Pro. It occurs when dovecot is configured to use per-domain passwd files placed one directory above /etc or when slash is allowed in domain components, enabling unintended reading of sensitive files like /etc/passwd. This can lead to incorrect authentication or unexpected validation of system users. No public exploits are known. Mitigation involves upgrading to a fixed version, using a different authentication scheme that does not rely on paths, or relocating per-domain passwd files to a safer directory such as /etc/dovecot/auth/%d.
ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version. No publicly available exploits are known.
CVE-2025-59031 is a medium severity vulnerability in Open-Xchange GmbH's OX Dovecot Pro involving unsafe handling of zip-style attachments by a provided script for attachment to text conversion. Specially crafted OOXML documents can cause unintended files on the system to be indexed and included in full-text search (FTS) indexes, potentially exposing sensitive information to unauthorized actors. There are no known public exploits. Users are advised not to use the vulnerable script and instead use alternative tools such as FTS tika.