Threats Tagged 'cve-2026-42008'

Multiple critical security vulnerabilities affecting Dovecot 2.4.4 and related versions in Red Hat Enterprise Linux 8 have been addressed in an update to version 2.3.16-16.el8_10. These vulnerabilities include denial of service, authentication bypass, and remote code execution issues across various Dovecot components such as IMAP, ManageSieve, and sieve scripts. The update fixes critical issues including a use-after-free leading to arbitrary code execution and several denial of service vulnerabilities caused by malformed inputs or resource exhaustion.

CVE-2026-42008 is an improper authentication vulnerability in Open-Xchange GmbH OX Dovecot Pro. It occurs because forwarding information from trusted proxy hosts is not separated from Dovecot's internal authentication fields, allowing injection of authentication data. Hosts configured as trusted proxies can authenticate as any user without knowing the user's password if the deployment honors passwordless authentication fields. Deployments without trusted proxies configured are not affected. No public exploits are known. The CVSS score is 4.3, indicating medium severity.