CVE-2026-73209 is a vulnerability in Open-Xchange GmbH OX Dovecot Pro where an attacker with valid credentials can send specially crafted compressed data that triggers uncontrolled recursion, causing the affected process to exhaust its stack and crash. This results in termination of the process and can lead to degradation or denial of service for the IMAP service. No public exploits are known for this vulnerability.
CVE-2026-73208 is an improper authentication vulnerability in Open-Xchange GmbH OX Dovecot Pro. It occurs when an OAuth2 token response lacks a scope claim, causing the system to use the audience claim instead for scope validation. This can allow an attacker holding a token intended for a different purpose to authenticate improperly if the audience claim matches a configured scope name. The issue also reveals identity provider misconfigurations where scopes are not issued. No public exploits are known. Users should ensure identity providers issue scope claims and avoid matching audience values with scope names. Updating to a non-vulnerable version is recommended.
CVE-2026-52687 is a vulnerability in Open-Xchange GmbH's OX Dovecot Pro that allows an authenticated attacker to cause uncontrolled resource consumption by selecting a compression algorithm for IMAP connections that requires excessive memory for decompression. This can lead to process termination and denial of service for IMAP. No public exploits are known. Mitigation includes disabling IMAP compression or limiting connections per imap-login process, with a recommendation to update to a non-vulnerable version.
CVE-2026-52681 is a vulnerability in Open-Xchange GmbH OX Dovecot Pro involving excessive CPU and disk resource consumption. An attacker with valid credentials can bypass the configured Sieve CPU limit by repeatedly changing the active script, resetting CPU usage accounting. Additionally, compiled script files are not removed when scripts are deleted or renamed, leading to increased disk consumption. These issues can degrade mail delivery service. No public exploits are known, and the CVSS score rates this as a low-severity issue.
CVE-2026-42395 is a medium severity vulnerability in Open-Xchange GmbH's OX Dovecot Pro. It involves uncontrolled resource consumption caused by a trusted proxy sending forwarding information containing a NUL byte, which crashes the login process on subsequent login attempts. This can lead to degradation or denial of service for logins. Systems not configured with trusted proxies are not affected.
CVE-2026-42393 is a vulnerability in Open-Xchange GmbH OX Dovecot Pro where the comparison for the doveadm password and API key is not fully timing safe. This flaw allows an attacker on the same network to infer the length of the secret by measuring response timing, potentially reducing the effort needed to guess the secret. The secret itself is not disclosed. No public exploits are known, and the vulnerability has a low severity rating.
CVE-2026-42392 is a medium severity vulnerability in Open-Xchange GmbH OX Dovecot Pro version 2.3.0. An attacker with valid credentials can send an invalid IMAP URLFETCH command that causes uninitialized memory to be included in the error response. This may disclose process memory contents, potentially exposing sensitive data. No public exploits are known. Mitigation includes disabling the IMAP URLAUTH functionality and updating to a non-vulnerable version if available.
CVE-2026-42391 is a high-severity vulnerability in Open-Xchange GmbH OX Dovecot Pro where an unauthenticated attacker can send an IMAP ID command with many parameters before login, causing excessive memory and CPU usage. This can lead to termination of the login process and denial of service for IMAP logins. No public exploits are known. Mitigation includes limiting connections per imap-login process or updating to a non-vulnerable version.
CVE-2026-42008 is an improper authentication vulnerability in Open-Xchange GmbH OX Dovecot Pro. It occurs because forwarding information from trusted proxy hosts is not separated from Dovecot's internal authentication fields, allowing injection of authentication data. Hosts configured as trusted proxies can authenticate as any user without knowing the user's password if the deployment honors passwordless authentication fields. Deployments without trusted proxies configured are not affected. No public exploits are known. The CVSS score is 4.3, indicating medium severity.
CVE-2026-42007 is a critical use-after-free vulnerability in Open-Xchange GmbH's OX Dovecot Pro. An attacker with valid credentials can exploit the Sieve editheader extension to cause memory corruption during mail delivery, potentially leading to arbitrary code execution. The vulnerability can crash the mail delivery process and leak memory. Disabling the Sieve editheader extension or updating to a non-vulnerable version mitigates the issue. No public exploits are currently known.
CVE-2026-40205 is an improper authentication vulnerability in Open-Xchange GmbH OX Dovecot Pro. The issue arises when OAuth2 tokens with only partial required scopes are accepted by remote token validation paths, despite the configured authorization policy requiring all scopes. This results in tokens with incomplete permissions being accepted incorrectly. Local token validation correctly enforces all required scopes. No public exploits are known, and the vulnerability has a medium severity rating.
CVE-2026-40204 is a low severity vulnerability in Open-Xchange GmbH's OX Dovecot Pro involving improper access control. It affects specific versions 2.3.0, 3.0.0, and 3.1.0 of the product. No public exploits are known, and there is no confirmed remediation or patch available at this time.
CVE-2026-40203 is a low-severity vulnerability in Open-Xchange GmbH OX Dovecot Pro related to IMAP compression reuse. When IMAP compression is enabled, the compression state is reused across responses in a session, causing response sizes to depend on both attacker-supplied and other mailbox mail. This allows an attacker who can send mail to a user and observe the user's IMAP traffic sizes to confirm if a small message body matches a guessed text. There is no demonstration of recovering arbitrary unknown content. Disabling IMAP compression or updating to a non-vulnerable version mitigates the issue. No public exploits are known.
CVE-2026-40019 is a medium severity vulnerability in Open-Xchange GmbH's OX Dovecot CE version 2.4.3. An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, causing it to enter an infinite loop that consumes CPU resources. This can degrade or deny service for Sieve script management. No public exploits are known, and no official patch or remediation level has been confirmed.
CVE-2026-40018 is a high-severity SQL Injection vulnerability in Open-Xchange GmbH's OX Dovecot Pro version 2.3.0. It allows improper neutralization of special elements used in SQL commands, potentially leading to unauthorized data access or modification. No public exploits are known at this time, and no official patch or remediation guidance has been provided by the vendor.
CVE-2026-40017 is a vulnerability in Open-Xchange GmbH OX Dovecot Pro where an attacker who can send mail to a user crafts message headers that cause excessive CPU consumption during IMAP THREAD command processing. This leads to potential denial of service or performance degradation when the THREAD command is issued on the affected mailbox. The issue is distinct from CVE-2026-40014 and is not fixed by that update. No public exploits are known. Monitoring for abnormal CPU usage and removing offending messages can mitigate impact until an update is applied.
CVE-2026-40015 is a medium severity vulnerability in Open-Xchange GmbH's OX Dovecot Pro. It involves an out-of-bounds read triggered by an attacker with valid credentials who opens many connections to the imap-hibernate service and sends invalid commands. This can intermittently crash the process, disrupting hibernated IMAP sessions and causing service degradation. No public exploits are known. Mitigation includes disabling IMAP hibernation and updating to a non-vulnerable version.
CVE-2026-40014 is a medium severity vulnerability in Open-Xchange GmbH OX Dovecot Pro that allows an attacker who can send mail to a user to craft a message header causing the IMAP THREAD command to consume excessive CPU resources. This can degrade or deny IMAP service when a mail client issues the THREAD command on the affected mailbox. No public exploits are known. Mitigation involves monitoring for abnormal CPU usage, killing offending processes, removing malicious messages, and updating to a non-vulnerable version if available.
CVE-2026-40013 is a buffer underwrite vulnerability in Open-Xchange GmbH OX Dovecot Pro's ManageSieve service. An attacker with valid credentials can submit a Sieve script containing an extreme numeric literal that triggers an out-of-bounds write during script compilation. This leads to memory corruption and crashes the ManageSieve process, causing denial of service for script management. There are no known public exploits. Disabling the ManageSieve service if not needed and updating to a non-vulnerable version are recommended.
CVE-2026-33607 is a medium severity vulnerability in Open-Xchange GmbH's OX Dovecot Pro. An attacker with valid credentials can exploit the IMAP LIST command to cause excessive CPU consumption, potentially leading to degradation or denial of service of the IMAP service. No public exploits are known. Mitigation involves monitoring for abnormal CPU usage, terminating offending processes, locking the associated account, or installing a fixed version if available.