Threats Tagged 'cve-2026-42392'

Multiple critical security vulnerabilities affecting Dovecot 2.4.4 and related versions in Red Hat Enterprise Linux 8 have been addressed in an update to version 2.3.16-16.el8_10. These vulnerabilities include denial of service, authentication bypass, and remote code execution issues across various Dovecot components such as IMAP, ManageSieve, and sieve scripts. The update fixes critical issues including a use-after-free leading to arbitrary code execution and several denial of service vulnerabilities caused by malformed inputs or resource exhaustion.

CVE-2026-42392 is a vulnerability in Open-Xchange GmbH OX Dovecot Pro version 2.3.0 where an attacker with valid credentials can cause the server to include uninitialized memory in error responses to an invalid IMAP URLFETCH command. This memory disclosure may expose sensitive information. The vulnerability has a medium severity with a CVSS score of 4.3. No public exploits are known. Mitigation includes disabling the IMAP URLAUTH functionality and updating to a non-vulnerable version.

CVE-2026-42392 is a medium severity vulnerability in Open-Xchange GmbH OX Dovecot Pro version 2.3.0. An attacker with valid credentials can send an invalid IMAP URLFETCH command that causes uninitialized memory to be included in the error response. This may disclose process memory contents, potentially exposing sensitive data. No public exploits are known. Mitigation includes disabling the IMAP URLAUTH functionality and updating to a non-vulnerable version if available.