Threats Tagged 'cve-2026-33604'

Multiple critical security vulnerabilities affecting Dovecot 2.4.4 and related versions in Red Hat Enterprise Linux 8 have been addressed in an update to version 2.3.16-16.el8_10. These vulnerabilities include denial of service, authentication bypass, and remote code execution issues across various Dovecot components such as IMAP, ManageSieve, and sieve scripts. The update fixes critical issues including a use-after-free leading to arbitrary code execution and several denial of service vulnerabilities caused by malformed inputs or resource exhaustion.

CVE-2026-33604 is a medium severity vulnerability in Open-Xchange GmbH OX Dovecot Pro that allows an attacker to bypass outbound protections by injecting crafted line endings in message bodies relayed through Dovecot. This can cause downstream mail servers vulnerable to SMTP smuggling to interpret parts of the message body as SMTP commands, enabling spoofed email injection. No public exploits are known. Users should update to a non-vulnerable version and ensure receiving mail servers reject bare carriage returns in message data.

CVE-2026-33604 is a medium severity vulnerability in Open-Xchange GmbH OX Dovecot Pro that allows an attacker to bypass outbound message content protections by using crafted message lines ending in the body. This can trick downstream mail servers that have not fixed SMTP smuggling vulnerabilities into interpreting part of the message body as SMTP commands, enabling injection of spoofed emails. No public exploits are known. Users controlling receiving mail servers should ensure rejection of bare carriage returns in message data and update to a non-vulnerable version when available.