GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Search

Find a vulnerability

Search criteria

    4 vulnerabilities found for Security Advisory by Dovecot

    GCVE-1988-2026-0382

    Vulnerability from gna-1988 – Published: 2026-09-11 11:55 – Updated: 2026-09-11 11:55
    VLAI
    Title
    Dovecot Security Advisory 3/2026
    Summary
    Hi! We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. This advisory will also be published at https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html --- Classification: TLP:GREEN Internal reference: DOV-8476 Type: CWE-403 (Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core =3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2025-11-25 Solution date: 2026-08-26 Disclosure date: 2026-08-26 CVE: CVE-2026-33263 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Details: submission-login: Panic when mail_max_userip_connections is reached: Panic: epoll_ctl(del, 8) failed: Bad file descriptor. When mail_max_userip_connections is set (defaul t 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. Risk: If running in high-security mode (default for community releases), only the new submission connection gets terminated. If running in high-performance mode (default for Pr o releases), all connections handled by the submission-login process will be terminated. The crashes can cause failure for user to send a message, or it can cause duplica te messages to be sent. If TLS is not used (in the backend server processing the submission), duplicate deliveries cannot happen, because the crash can only happen at AUT H stage. No publicly available exploits are known. Solution: Limit the number of connections handled by single submission-login process. This has a performance impact though. Update to non-vulnerable version. --- Internal reference: DOV-8874 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <3.0.7, OX Dovecot Pro core >=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-03-11 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: ylwango613@yeswehack CVE: CVE-2026-33607 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Details: Dovecot IMAP LIST match_sub() Exponential Backtracking — CPU Denial of Service. An attacker that has valid credentials can use IMAP LIST command to consume CPU. Risk: This can cause degradation or denial of service for IMAP. No publicly available exploits are known. Solution: Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. --- Internal reference: DOV-8884 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core =3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-03-13 Solution date: 2026-08-26 Disclosure date: 2026-08-26 CVE: CVE-2026-27852 CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Details: DoS by sending mail with bad header. An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME par ameters, which causes excessive memory usage when the message is later parsed. Risk: The message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, causing denial of service for the affected user. No publicly available exploits are known. Solution: Update to non-vulnerable version. --- Internal reference: DOV-8941 Type: CWE-93 (Improper Neutralization of CRLF Sequences ('CRLF Injection')) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core =3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-03-24 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: thanos_haruki@yeswehack CVE: CVE-2026-33606 CVSS: 4.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N) Details: dsync: Mail content can cause dsync protocol injection. Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administ rator later runs dsync with the stream protocol, for example during a migration. Risk: Injected commands can modify mailbox state on the destination during migration or replication, including internal mailbox attributes that a user should not be able to set directly. It can also cause dsync errors. No publicly available exploits are known. Solution: Avoid running dsync with the stream protocol on mailboxes with untrusted content. Update to non-vulnerable version. --- Internal reference: DOV-8947 Type: CWE-655 (Insufficient Psychological Acceptability) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core =3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-03-24 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: heckintosh@yeswehack CVE: CVE-2026-33604 CVSS: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Details: SMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return. An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. Risk: A downstream mail server that hasn't yet fixed the SMTP smuggling vulnerability can be tricked into treating part of the message body as new SMTP commands, allowing injec tion of spoofed email. This is the same vulnerability class as CVE-2023-51764 and CVE-2023-51766. No publicly available exploits are known. Solution: Where you control the receiving mail servers, ensure they reject bare carriage returns in message data. Update to non-vulnerable version. --- Internal reference: DOV-8949 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core =3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-03-24 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: djvirus@yeswehack CVE: CVE-2026-40014 CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Details: IMAP THREAD REFERENCES O(N²) CPU DoS via Crafted References Header (index-thread-links.c). An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. Risk: When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. No publicly available exploits are known. Solution: Monitor system for abnormal CPU usage, kill the offending process and remove the offending message from the affected mailbox. Update to non-vulnerable version. --- Internal reference: DOV-8991 Type: CWE-124 (Buffer Underwrite ('Buffer Underflow')) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core =3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-04-02 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: ilyar@yeswehack CVE: CVE-2026-40013 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Details: pigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT. An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script. Risk: This causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of service for script management. This might be able to be used for re mote code execution. No publicly available exploits are known. Solution: Disable the ManageSieve service if users do not need remote Sieve script management. Update to non-vulnerable version. --- Internal reference: DOV-8994 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core =3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-04-02 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: ilyar@yeswehack CVE: CVE-2026-33605 CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Details: managesieve-login: Pre-auth crash. An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. Risk: If running in high-security mode (default for community releases), only the attacker's own connection is terminated. If running in high-performance mode (default for Pro releases), all connections handled by the same managesieve-login process are terminated. Repeating the attack can cause denial of service for Sieve script management. No publicly available exploits are known. Solution: Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. --- Internal reference: DOV-9039 Type: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-04-08 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: tipsennn@yeswehack CVE: CVE-2026-40018 CVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Details: MySQL multi-byte escaping wrong. None Risk: None No publicly available exploits are known. Solution: None --- Internal reference: DOV-9041 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot CE core >=2.4.3 <2.4.5 First fixed revision: OX Dovecot CE core 2.4.5 Discovery date: 2026-04-08 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: ilyar@yeswehack CVE: CVE-2026-4
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Credits
    Aki Tuomi
    Relationships
    reference GCVE-1988-2026-0382 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Security Advisory",
          "vendor": "Dovecot",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aki Tuomi"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hi!\n\nWe\u0027re sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those \nvulnerabilities. This advisory will also be published at \nhttps://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html\n\n---\n\nClassification: TLP:GREEN\n\nInternal reference: DOV-8476\nType: CWE-403 (Exposure of File Descriptor to Unintended Control Sphere (\u0027File Descriptor Leak\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2025-11-25\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nCVE: CVE-2026-33263\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nsubmission-login: Panic when mail_max_userip_connections is reached: Panic: epoll_ctl(del, 8) failed: Bad file \ndescriptor. When mail_max_userip_connections is set (defaul\nt 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues.\n\nRisk:\nIf running in high-security mode (default for community releases), only the new submission connection gets terminated. \nIf running in high-performance mode (default for Pr\no releases), all connections handled by the submission-login process will be terminated. The crashes can cause failure \nfor user to send a message, or it can cause duplica\nte messages to be sent. If TLS is not used (in the backend server processing the submission), duplicate deliveries \ncannot happen, because the crash can only happen at AUT\nH stage. No publicly available exploits are known.\n\nSolution:\nLimit the number of connections handled by single submission-login process. This has a performance impact though. \nUpdate to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8874\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c3.0.7, OX Dovecot Pro core \u003e=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \n\u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5\nDiscovery date: 2026-03-11\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ylwango613@yeswehack\nCVE: CVE-2026-33607\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nDovecot IMAP LIST match_sub() Exponential Backtracking \u2014 CPU Denial of Service. An attacker that has valid credentials \ncan use IMAP LIST command to consume CPU.\n\nRisk:\nThis can cause degradation or denial of service for IMAP. No publicly available exploits are known.\n\nSolution:\nMonitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed \nversion.\n\n\n\n---\n\n\n\nInternal reference: DOV-8884\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-13\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nCVE: CVE-2026-27852\nCVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nDetails:\nDoS by sending mail with bad header. An attacker that can send mail to a user can craft a message whose headers contain \na very large number of email addresses or MIME par\nameters, which causes excessive memory usage when the message is later parsed.\n\nRisk:\nThe message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, \ncausing denial of service for the affected user. No\n publicly available exploits are known.\n\nSolution:\nUpdate to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8941\nType: CWE-93 (Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-24\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: thanos_haruki@yeswehack\nCVE: CVE-2026-33606\nCVSS: 4.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N)\n\nDetails:\ndsync: Mail content can cause dsync protocol injection. Mail content stored by a user can be crafted so that it is \ninterpreted as dsync protocol commands when an administ\nrator later runs dsync with the stream protocol, for example during a migration.\n\nRisk:\nInjected commands can modify mailbox state on the destination during migration or replication, including internal \nmailbox attributes that a user should not be able to set\n directly. It can also cause dsync errors. No publicly available exploits are known.\n\nSolution:\nAvoid running dsync with the stream protocol on mailboxes with untrusted content. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8947\nType: CWE-655 (Insufficient Psychological Acceptability)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-24\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: heckintosh@yeswehack\nCVE: CVE-2026-33604\nCVSS: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)\n\nDetails:\nSMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return. An attacker that can get Dovecot to relay a \nmessage, for example through Sieve redirect or submission \nrelay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message \ncontent from being interpreted as SMTP commands.\n\nRisk:\nA downstream mail server that hasn\u0027t yet fixed the SMTP smuggling vulnerability can be tricked into treating part of \nthe message body as new SMTP commands, allowing injec\ntion of spoofed email. This is the same vulnerability class as CVE-2023-51764 and CVE-2023-51766. No publicly available \nexploits are known.\n\nSolution:\nWhere you control the receiving mail servers, ensure they reject bare carriage returns in message data. Update to \nnon-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8949\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-24\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: djvirus@yeswehack\nCVE: CVE-2026-40014\nCVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)\n\nDetails:\nIMAP THREAD REFERENCES O(N\u00b2) CPU DoS via Crafted References Header (index-thread-links.c). An attacker that can send \nmail to a user can craft a message header that makes \nthe IMAP THREAD command consume CPU disproportionate to the size of the message.\n\nRisk:\nWhen a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for \nIMAP. No publicly available exploits are known.\n\nSolution:\nMonitor system for abnormal CPU usage, kill the offending process and remove the offending message from the affected \nmailbox. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8991\nType: CWE-124 (Buffer Underwrite (\u0027Buffer Underflow\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-04-02\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ilyar@yeswehack\nCVE: CVE-2026-40013\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\npigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT. An attacker that has valid \ncredentials can submit a Sieve script containing an extreme\n numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script.\n\nRisk:\nThis causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of service for \nscript management. This might be able to be used for re\nmote code execution. No publicly available exploits are known.\n\nSolution:\nDisable the ManageSieve service if users do not need remote Sieve script management. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8994\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-04-02\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ilyar@yeswehack\nCVE: CVE-2026-33605\nCVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nDetails:\nmanagesieve-login: Pre-auth crash. An unauthenticated attacker can crash the ManageSieve login process by sending a \nsmall malformed command before authenticating.\n\nRisk:\nIf running in high-security mode (default for community releases), only the attacker\u0027s own connection is terminated. If \nrunning in high-performance mode (default for Pro \nreleases), all connections handled by the same managesieve-login process are terminated. Repeating the attack can cause \ndenial of service for Sieve script management. No \npublicly available exploits are known.\n\nSolution:\nRestrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-9039\nType: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5\nDiscovery date: 2026-04-08\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: tipsennn@yeswehack\nCVE: CVE-2026-40018\nCVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)\n\nDetails:\nMySQL multi-byte escaping wrong. None\n\nRisk:\nNone No publicly available exploits are known.\n\nSolution:\nNone\n\n\n\n---\n\n\n\nInternal reference: DOV-9041\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot CE core \u003e=2.4.3 \u003c2.4.5\nFirst fixed revision: OX Dovecot CE core 2.4.5\nDiscovery date: 2026-04-08\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ilyar@yeswehack\nCVE: CVE-2026-4"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1050",
              "description": "CWE-1050",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-124",
              "description": "CWE-124",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-125",
              "description": "CWE-125",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-200",
              "description": "CWE-200",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-284",
              "description": "CWE-284",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-287",
              "description": "CWE-287",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-403",
              "description": "CWE-403",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-416",
              "description": "CWE-416",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-655",
              "description": "CWE-655",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-674",
              "description": "CWE-674",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-93",
              "description": "CWE-93",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:55:53Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/116"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/116"
        },
        {
          "url": "https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/116"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Dovecot Security Advisory 3/2026",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2023-51764",
              "type": "related"
            },
            {
              "destId": "CVE-2023-51766",
              "type": "related"
            },
            {
              "destId": "CVE-2026-27852",
              "type": "related"
            },
            {
              "destId": "CVE-2026-33263",
              "type": "related"
            },
            {
              "destId": "CVE-2026-33604",
              "type": "related"
            },
            {
              "destId": "CVE-2026-33605",
              "type": "related"
            },
            {
              "destId": "CVE-2026-33606",
              "type": "related"
            },
            {
              "destId": "CVE-2026-33607",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40013",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40014",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40015",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40017",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40018",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40019",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40203",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40204",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40205",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42007",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42008",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42391",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42392",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42393",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42395",
              "type": "related"
            },
            {
              "destId": "CVE-2026-52681",
              "type": "related"
            },
            {
              "destId": "CVE-2026-52687",
              "type": "related"
            },
            {
              "destId": "CVE-2026-73208",
              "type": "related"
            },
            {
              "destId": "CVE-2026-73209",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0382",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/116",
            "automated": true,
            "contentSha256": "01aaf8800660f758cbc04e020b53167b1553f36c4c558df09e8389481ca8dfa0",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/116",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-28T10:07:32Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0382"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T11:55:53Z",
    "dateUpdated": "2026-09-11T11:55:53Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0382"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0253

    Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-11 11:23
    VLAI
    Title
    Dovecot Security Advisory OXDC-2026-0002
    Summary
    Hi! We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. This advisory is also published at https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0002.html --- Classification: TLP:GREEN Internal reference: DOV-8967 Type: CWE-235 (Improper Handling of Extra Parameters) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 3.1.4, OX Dovecot CE core 2.4.3 First fixed revision: OX Dovecot Pro core 3.1.5, OX Dovecot CE core 2.4.4 Discovery date: 2026-03-29 Solution date: 2026-05-05 Disclosure date: 2026-05-05 Researcher credits: caprinuxx@yeswehack CVE: CVE-2026-27851 CVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Details: lib-var-expand: Safe filter leaks to all following pipelines. When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. Risk: This can enable SQL / LDAP injection attacks when used in authentication. No publicly available exploits are known. Solution: Avoid using safe filter until on fixed version. --- Internal reference: DOV-8948 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 2.3.0 First fixed revision: OX Dovecot Pro core 3.1.5, OX Dovecot CE core 2.4.4 Discovery date: 2026-03-24 Solution date: 2026-05-05 Disclosure date: 2026-05-05 Researcher credits: djvirus@yeswehack CVE: CVE-2026-40016 CVSS: 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Details: Sieve :contains/:matches O(N×M) Substring Match Bypasses sieve_max_cpu_time Limit (130× Overrun). Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the configured limit. Risk: Attacker can use this to degrade server performance and bypass configured CPU time limits for Sieve scripts. No publicly available exploits are known. Solution: Install fixed version, or alternatively prevent direct access to Sieve scripts via ManageSieve or local access. --- Internal reference: DOV-9030 Type: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection')) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0 First fixed revision: OX Dovecot Pro core 3.1.5, OX Dovecot CE core 2.4.4 Discovery date: 2026-04-08 Solution date: 2026-05-05 Disclosure date: 2026-05-05 Researcher credits: ylwango613@yeswehack CVE: CVE-2026-33603 CVSS: 6.8 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Details: login: Base64 input can contain tabs that bypass IPC protection. Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to position itself between Dovecot and the client connection. Risk: If successful, the attacker can eavesdrop communications between Dovecot and client as MITM proxy. No publicly available exploits are known. Solution: Install fixed version. --- Internal reference: DOV-9040 Type: CWE-284 (Improper Access Control) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 2.3.0 First fixed revision: OX Dovecot Pro core 3.1.5, OX Dovecot CE core 2.4.4 Discovery date: 2026-04-08 Solution date: 2026-05-05 Disclosure date: 2026-05-05 Researcher credits: ilhamaf@yeswehack CVE: CVE-2026-40020 CVSS: 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Details: IMAP folders can be shared-spammed to everyone. Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be spammed to all users. Risk: The impact is limited to being able to spam folders to other users, no unexpected access is gained. No publicly available exploits are known. Solution: Install to fixed version. --- Internal reference: DOV-9138 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 3.0.5, OX Dovecot Pro core 3.1.4, OX Dovecot CE core 2.4.3 First fixed revision: OX Dovecot Pro core 3.1.5, OX Dovecot CE core 2.4.4 Discovery date: 2026-04-27 Solution date: 2026-05-05 Disclosure date: 2026-05-05 Researcher credits: D4RKCYPH3R@yeswehack CVE: CVE-2026-42006 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Details: imap-login: Excessive memory usage DoS - Try 2. An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit. Risk: Using excessive bracing, attacker can cause memory usage up to configured memory limit. No publicly available exploits are known. Solution: Install fixed version, or configure vsz_limit for imap process to low value. _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Credits
    Aki Tuomi
    Relationships
    reference GCVE-1988-2026-0253 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Security Advisory",
          "vendor": "Dovecot",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aki Tuomi"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hi!\n\nWe\u0027re sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those \nvulnerabilities. This advisory is also published at \nhttps://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0002.html\n\n---\n\nClassification: TLP:GREEN\n\nInternal reference: DOV-8967\nType: CWE-235 (Improper Handling of Extra Parameters)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.1.4, OX Dovecot CE core 2.4.3\nFirst fixed revision: OX Dovecot Pro core 3.1.5, OX Dovecot CE core 2.4.4\nDiscovery date: 2026-03-29\nSolution date: 2026-05-05\nDisclosure date: 2026-05-05\nResearcher credits: caprinuxx@yeswehack\nCVE: CVE-2026-27851\nCVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)\n\nDetails:\nlib-var-expand: Safe filter leaks to all following pipelines. When safe filter is used with variable expansion, all \nfollowing pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped.\n\nRisk:\nThis can enable SQL / LDAP injection attacks when used in authentication. No publicly available exploits are known.\n\nSolution:\nAvoid using safe filter until on fixed version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8948\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 2.3.0\nFirst fixed revision: OX Dovecot Pro core 3.1.5, OX Dovecot CE core 2.4.4\nDiscovery date: 2026-03-24\nSolution date: 2026-05-05\nDisclosure date: 2026-05-05\nResearcher credits: djvirus@yeswehack\nCVE: CVE-2026-40016\nCVSS: 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)\n\nDetails:\nSieve :contains/:matches O(N\u00d7M) Substring Match Bypasses sieve_max_cpu_time Limit (130\u00d7 Overrun). Attacker can upload a \nmalicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 \ntimes of the configured limit.\n\nRisk:\nAttacker can use this to degrade server performance and bypass configured CPU time limits for Sieve scripts. No \npublicly available exploits are known.\n\nSolution:\nInstall fixed version, or alternatively prevent direct access to Sieve scripts via ManageSieve or local access.\n\n\n\n---\n\n\n\nInternal reference: DOV-9030\nType: CWE-99 (Improper Control of Resource Identifiers (\u0027Resource Injection\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot Pro core 3.1.5, OX Dovecot CE core 2.4.4\nDiscovery date: 2026-04-08\nSolution date: 2026-05-05\nDisclosure date: 2026-05-05\nResearcher credits: ylwango613@yeswehack\nCVE: CVE-2026-33603\nCVSS: 6.8 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)\n\nDetails:\nlogin: Base64 input can contain tabs that bypass IPC protection. Attacker can use a specially crafted base64 exchange \nbetween Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to position \nitself between Dovecot and the client connection.\n\nRisk:\nIf successful, the attacker can eavesdrop communications between Dovecot and client as MITM proxy. No publicly \navailable exploits are known.\n\nSolution:\nInstall fixed version.\n\n\n\n---\n\n\n\nInternal reference: DOV-9040\nType: CWE-284 (Improper Access Control)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 2.3.0\nFirst fixed revision: OX Dovecot Pro core 3.1.5, OX Dovecot CE core 2.4.4\nDiscovery date: 2026-04-08\nSolution date: 2026-05-05\nDisclosure date: 2026-05-05\nResearcher credits: ilhamaf@yeswehack\nCVE: CVE-2026-40020\nCVSS: 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nIMAP folders can be shared-spammed to everyone. Attacker can use the IMAP SETACL command to inject the anyone \npermission to user\u0027s dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be spammed to all users.\n\nRisk:\nThe impact is limited to being able to spam folders to other users, no unexpected access is gained. No publicly \navailable exploits are known.\n\nSolution:\nInstall to fixed version.\n\n\n\n---\n\n\n\nInternal reference: DOV-9138\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.0.5, OX Dovecot Pro core 3.1.4, OX Dovecot CE core 2.4.3\nFirst fixed revision: OX Dovecot Pro core 3.1.5, OX Dovecot CE core 2.4.4\nDiscovery date: 2026-04-27\nSolution date: 2026-05-05\nDisclosure date: 2026-05-05\nResearcher credits: D4RKCYPH3R@yeswehack\nCVE: CVE-2026-42006\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nimap-login: Excessive memory usage DoS - Try 2. An attacker can cause uncontrolled memory usage with excessive bracing \nover IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another \nway left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit.\n\nRisk:\nUsing excessive bracing, attacker can cause memory usage up to configured memory limit. No publicly available exploits \nare known.\n\nSolution:\nInstall fixed version, or configure vsz_limit for imap process to low value.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-235",
              "description": "CWE-235",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-284",
              "description": "CWE-284",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-99",
              "description": "CWE-99",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:23:37Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/2"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/2"
        },
        {
          "url": "https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0002.html"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/2"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Dovecot Security Advisory OXDC-2026-0002",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-27851",
              "type": "related"
            },
            {
              "destId": "CVE-2026-27857",
              "type": "related"
            },
            {
              "destId": "CVE-2026-33603",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40016",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40020",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42006",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0253",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/2",
            "automated": true,
            "contentSha256": "953cf42d8d2a923193fdd281db5329f9228543715cf0e022915cdd481a58619d",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/2",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-12T13:41:30Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0253"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-11T11:23:37Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0253"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0235

    Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-11 11:15
    VLAI
    Title
    Dovecot Security Advisory OXDC-2026-0001
    Summary
    Dear subscribers, we're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. This advisory is also published at https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html --- Classification: TLP:GREEN Internal reference: DOV-7830 Type: CWE-1250 (Improper Preservation of Consistency Between Independent Representations of Shared State) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0 First fixed revision: OX Dovecot CE core 2.4.1 Discovery date: 2025-07-24 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: Erik <erik () broadlux com> CVE: CVE-2025-30189 CVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Details: v2.4 regression: auth cache broken with several passdb / userdb. When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users. Risk: After cached login, all subsequent logins are for same user. No publicly available exploits are known. Solution: Install fixed version or disable caching either globally or for the impacted passdb/userdb drivers. --- Internal reference: DOV-8349 Type: CWE-20 (Improper Input Validation) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0 First fixed revision: OX Dovecot Pro core 3.1.2, OX Dovecot CE core 2.4.3 Discovery date: 2025-11-04 Solution date: 2026-03-27 Disclosure date: 2026-03-27 CVE: CVE-2025-59028 CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Details: Invalid base64 authentication can cause DoS for other logins. When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Risk: Invalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. No publicly available exploits are known. Solution: Install fixed version or disable concurrency in login processes (heavy perfomance penalty on large deployments). --- Internal reference: DOV-8508 Type: CWE-20 (Improper Input Validation) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0 First fixed revision: OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.3 Discovery date: 2025-11-29 Solution date: 2026-03-27 Disclosure date: 2026-03-27 CVE: CVE-2025-59032 CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Details: v2.4/v3.1 regression: Pigeonhole: ManageSieve panic occurs with sieve-connect as a client. ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. Risk: This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. No publicly available exploits are known. Solution: Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version. --- Internal reference: DOV-8584 Type: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 2.3.0 First fixed revision: OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.3, OX Dovecot Pro core 2.3.22.1 Discovery date: 2025-12-29 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: cavid@yeswehack CVE: CVE-2025-59031 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Details: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing. Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Risk: Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subsequently ending up in FTS indexes. No publicly available exploits are known. Solution: Do not use the provided script, instead, use something else like FTS tika. --- Internal reference: DOV-8591 Type: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 2.3.0 First fixed revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0 Discovery date: 2026-01-07 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: strokep@yeswehack CVE: CVE-2026-0394 CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Details: auth: Path traversal in passwd-file passdb using `%d` (domain) escapes base directory and opens `/etc/passwd`Pre-auth path traversal in passwd-file passdb using `%d` (domain) escapes base directory and opens `/etc/passwd`. When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added to allowed characters, path traversal can happen if the domain component is directory partial. Risk: This allows inadvertently reading /etc/passwd (or some other path which ends with passwd). If this file contains passwords, it can be used to authenticate wrongly, or if this is userdb, it can unexpectly make system users appear valid users. No publicly available exploits are known. Solution: Upgrade to fixed version, or use different authentication scheme that does not rely on paths. Alternatively you can also ensure that the per-domain passwd files are in some other location, such as /etc/dovecot/auth/%d. --- Internal reference: DOV-8775 Type: CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0 First fixed revision: OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4 Discovery date: 2026-02-20 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: cookiejack15@yeswehack CVE: CVE-2026-27860 CVSS: 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Details: v2.4/v3.1 regression: auth-ldap is not escaping usernames. If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. Risk: This leads to potentially bypassing restrictions and allows probing of LDAP structure. No publicly available exploits are known. Solution: Do not clear out auth_username_chars, or install fixed version. --- Internal reference: DOV-8781 Type: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0 First fixed revision: OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4 Discovery date: 2026-02-23 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: whisperer@yeswehack CVE: CVE-2026-24031 CVSS: 7.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) Details: v2.4/v3.1 regression: SQL injection allows bypassing authentication. Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. Risk: This vulnerability allows bypassing authentication for any user and user enumeration. No publicly available exploits are known. Solution: Do not clear auth_username_chars. If this is not possible, install latest fixed version. --- Internal reference: DOV-8787 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 3.0.2, OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0 First fixed revision: OX Dovecot Pro core 3.0.5, OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4 Discovery date: 2026-02-24 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: djvirus@yeswehack CVE: CVE-2026-27859 CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Details: v3.0.2+ regression: Message headers MIME parameter parsing can cause excessive CPU usage. A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU. Risk: A suitably formatted mail message causes mail delivery process to consume large amounts of CPU time. No publicly available exploits are known. Solution: Use MTA capabilities to limit RFC 2231 MIME parameters in mail messages, or upgrade to fixed version where the processing is limited. --- Internal reference: DOV-8816 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 2.3.0 First fixed revision: OX Dovecot Pro core 3.0.5, OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4, OX Dovecot Pro core 2.3.22.1 Discovery date: 2026-02-27 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: whisperer@yeswehack CVE: CVE-2026-27857 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Details: imap-login: Excessive memory usage DoS. Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection. This 1 MB can be left allocated for longer time periods by not sending the command ending LF. So attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the process and its other proxied connections. Risk: Attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the process and its other proxied connections. No publicly available exploits are known. Solution: Install fixed version, there is no other remediation. --- Internal reference: DOV-8818 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 2.3.0, OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0 First fixed revision: OX Dovecot Pro core 3.0.5, OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4, OX Dovecot Pro core 2.3.22.1 Discovery date: 2026-02-28 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: ilyar@yeswehack CVE: CVE-2026-27858 CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Details: managesieve-login out-of-memory DoS. Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Risk: Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. No publicly available exploits are known. Solution: Protect access to managesieve protocol, or install fixed version. --- Internal reference: DOV-8830 Type: CWE-287 (Improper Authentication) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 2.3.0 First fixed revision: OX Dovecot Pro core 3.0.5, OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4, OX Dovecot Pro core 2.3.22.1 Discovery date: 2026-03-04 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: bksparajuli@yeswehack CVE: CVE-2026-27856 CVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Details: doveadm: Credentials verified without timing safety. Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured credentials. Risk: Figuring out the credential will le
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Credits
    Aki Tuomi
    Relationships
    reference GCVE-1988-2026-0235 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Security Advisory",
          "vendor": "Dovecot",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aki Tuomi"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Dear subscribers,\n\nwe\u0027re sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those \nvulnerabilities. This advisory is also published at \nhttps://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html\n\n\n---\n\n\nClassification: TLP:GREEN\n\nInternal reference: DOV-7830\nType: CWE-1250 (Improper Preservation of Consistency Between Independent Representations of Shared State)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot CE core 2.4.1\nDiscovery date: 2025-07-24\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: Erik  \u003cerik () broadlux com\u003e\nCVE: CVE-2025-30189\nCVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)\n\nDetails:\nv2.4 regression: auth cache broken with several passdb / userdb. When cache is enabled, some passdb/userdb drivers \nincorrectly cache all users with same cache key, causing wrong cached information to be used for these users.\n\nRisk:\nAfter cached login, all subsequent logins are for same user. No publicly available exploits are known.\n\nSolution:\nInstall fixed version or disable caching either globally or for the impacted passdb/userdb drivers.\n\n\n\n---\n\n\n\nInternal reference: DOV-8349\nType: CWE-20 (Improper Input Validation)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot Pro core 3.1.2, OX Dovecot CE core 2.4.3\nDiscovery date: 2025-11-04\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nCVE: CVE-2025-59028\nCVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nInvalid base64 authentication can cause DoS for other logins. When sending invalid base64 SASL data, login process is \ndisconnected from the auth server, causing all active authentication sessions to fail.\n\nRisk:\nInvalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. No publicly available exploits \nare known.\n\nSolution:\nInstall fixed version or disable concurrency in login processes (heavy perfomance penalty on large deployments).\n\n\n\n---\n\n\n\nInternal reference: DOV-8508\nType: CWE-20 (Improper Input Validation)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.3\nDiscovery date: 2025-11-29\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nCVE: CVE-2025-59032\nCVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nDetails:\nv2.4/v3.1 regression: Pigeonhole: ManageSieve panic occurs with sieve-connect as a client. ManageSieve AUTHENTICATE \ncommand crashes when using literal as SASL initial response.\n\nRisk:\nThis can be used to crash ManageSieve service repeatedly, making it unavailable for other users. No publicly available \nexploits are known.\n\nSolution:\nControl access to ManageSieve port, or disable the service if it\u0027s not needed. Alternatively upgrade to a fixed version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8584\nType: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 2.3.0\nFirst fixed revision: OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.3, OX Dovecot Pro core 2.3.22.1\nDiscovery date: 2025-12-29\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: cavid@yeswehack\nCVE: CVE-2025-59031\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)\n\nDetails:\ndecode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing. Dovecot has provided a \nscript to use for attachment to text conversion. This script unsafely handles zip-style attachments.\n\nRisk:\nAttacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and \nsubsequently ending up in FTS indexes. No publicly available exploits are known.\n\nSolution:\nDo not use the provided script, instead, use something else like FTS tika.\n\n\n\n---\n\n\n\nInternal reference: DOV-8591\nType: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 2.3.0\nFirst fixed revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nDiscovery date: 2026-01-07\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: strokep@yeswehack\nCVE: CVE-2026-0394\nCVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)\n\nDetails:\nauth: Path traversal in passwd-file passdb using `%d` (domain) escapes base directory and opens `/etc/passwd`Pre-auth \npath traversal in passwd-file passdb using `%d` (domain) escapes base directory and opens `/etc/passwd`. When dovecot \nhas been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has \nbeen added to allowed characters, path traversal can happen if the domain component is directory partial.\n\nRisk:\nThis allows inadvertently reading /etc/passwd (or some other path which ends with passwd). If this file contains \npasswords, it can be used to authenticate wrongly, or if this is userdb, it can unexpectly make system users appear \nvalid users.  No publicly available exploits are known.\n\nSolution:\nUpgrade to fixed version, or use different authentication scheme that does not rely on paths. Alternatively you can \nalso ensure that the per-domain passwd files are in some other location, such as /etc/dovecot/auth/%d.\n\n\n\n---\n\n\n\nInternal reference: DOV-8775\nType: CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4\nDiscovery date: 2026-02-20\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: cookiejack15@yeswehack\nCVE: CVE-2026-27860\nCVSS: 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)\n\nDetails:\nv2.4/v3.1 regression: auth-ldap is not escaping usernames. If auth_username_chars is empty, it is possible to inject \narbitrary LDAP filter to Dovecot\u0027s LDAP authentication.\n\nRisk:\nThis leads to potentially bypassing restrictions and allows probing of LDAP structure. No publicly available exploits \nare known.\n\nSolution:\nDo not clear out auth_username_chars, or install fixed version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8781\nType: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4\nDiscovery date: 2026-02-23\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: whisperer@yeswehack\nCVE: CVE-2026-24031\nCVSS: 7.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L)\n\nDetails:\nv2.4/v3.1 regression: SQL injection allows bypassing authentication. Dovecot SQL based authentication can be bypassed \nwhen auth_username_chars is cleared by admin.\n\nRisk:\nThis vulnerability allows bypassing authentication for any user and user enumeration. No publicly available exploits \nare known.\n\nSolution:\nDo not clear auth_username_chars. If this is not possible, install latest fixed version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8787\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.0.2, OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot Pro core 3.0.5, OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4\nDiscovery date: 2026-02-24\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: djvirus@yeswehack\nCVE: CVE-2026-27859\nCVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nv3.0.2+ regression: Message headers MIME parameter parsing can cause excessive CPU usage. A mail message containing \nexcessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU.\n\nRisk:\nA suitably formatted mail message causes mail delivery process to consume large amounts of CPU time. No publicly \navailable exploits are known.\n\nSolution:\nUse MTA capabilities to limit RFC 2231 MIME parameters in mail messages, or upgrade to fixed version where the \nprocessing is limited.\n\n\n\n---\n\n\n\nInternal reference: DOV-8816\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 2.3.0\nFirst fixed revision: OX Dovecot Pro core 3.0.5, OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4, OX Dovecot Pro \ncore 2.3.22.1\nDiscovery date: 2026-02-27\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: whisperer@yeswehack\nCVE: CVE-2026-27857\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nimap-login: Excessive memory usage DoS. Sending \"NOOP (((...)))\" command with 4000 parenthesis open+close results in \n~1MB extra memory usage. Longer commands will result in client disconnection. This 1 MB can be left allocated for \nlonger time periods by not sending the command ending LF. So attacker could connect possibly from even a single IP and \ncreate 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the \nprocess and its other proxied connections.\n\nRisk:\nAttacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which \nwould likely result in reaching VSZ limit and killing the process and its other proxied connections. No publicly \navailable exploits are known.\n\nSolution:\nInstall fixed version, there is no other remediation.\n\n\n\n---\n\n\n\nInternal reference: DOV-8818\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 2.3.0, OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot Pro core 3.0.5, OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4, OX Dovecot Pro \ncore 2.3.22.1\nDiscovery date: 2026-02-28\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: ilyar@yeswehack\nCVE: CVE-2026-27858\nCVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nDetails:\nmanagesieve-login out-of-memory DoS. Attacker can send a specifically crafted message before authentication that causes \nmanagesieve to allocate large amount of memory.\n\n\nRisk:\nAttacker can force managesieve-login to be unavailable by repeatedly crashing the process. No publicly available \nexploits are known.\n\nSolution:\nProtect access to managesieve protocol, or install fixed version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8830\nType: CWE-287 (Improper Authentication)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 2.3.0\nFirst fixed revision: OX Dovecot Pro core 3.0.5, OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4, OX Dovecot Pro \ncore 2.3.22.1\nDiscovery date: 2026-03-04\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: bksparajuli@yeswehack\nCVE: CVE-2026-27856\nCVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)\n\nDetails:\ndoveadm: Credentials verified without timing safety. Doveadm credentials are verified using direct comparison which is \nsusceptible to timing oracle attack. An attacker can use this to determine the configured credentials.\n\nRisk:\nFiguring out the credential will le"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1250",
              "description": "CWE-1250",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-20",
              "description": "CWE-20",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-200",
              "description": "CWE-200",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-22",
              "description": "CWE-22",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-287",
              "description": "CWE-287",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-294",
              "description": "CWE-294",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-90",
              "description": "CWE-90",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:15:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/13"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/13"
        },
        {
          "url": "https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/13"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Dovecot Security Advisory OXDC-2026-0001",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-30189",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59028",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59031",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59032",
              "type": "related"
            },
            {
              "destId": "CVE-2026-0394",
              "type": "related"
            },
            {
              "destId": "CVE-2026-24031",
              "type": "related"
            },
            {
              "destId": "CVE-2026-27855",
              "type": "related"
            },
            {
              "destId": "CVE-2026-27856",
              "type": "related"
            },
            {
              "destId": "CVE-2026-27857",
              "type": "related"
            },
            {
              "destId": "CVE-2026-27858",
              "type": "related"
            },
            {
              "destId": "CVE-2026-27859",
              "type": "related"
            },
            {
              "destId": "CVE-2026-27860",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0235",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/13",
            "automated": true,
            "contentSha256": "cd1c4fc48637eb40c941400f57d5835f8f7b88c32c348352184aedfe5768d08a",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/13",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-27T08:06:15Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0235"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:41Z",
    "dateUpdated": "2026-09-11T11:15:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0235"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0020

    Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:55
    VLAI
    Title
    Dovecot Security Advisory 3/2026
    Summary
    Hi! We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. This advisory will also be published at https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html --- Classification: TLP:GREEN Internal reference: DOV-8476 Type: CWE-403 (Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core =3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2025-11-25 Solution date: 2026-08-26 Disclosure date: 2026-08-26 CVE: CVE-2026-33263 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Details: submission-login: Panic when mail_max_userip_connections is reached: Panic: epoll_ctl(del, 8) failed: Bad file descriptor. When mail_max_userip_connections is set (defaul t 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. Risk: If running in high-security mode (default for community releases), only the new submission connection gets terminated. If running in high-performance mode (default for Pr o releases), all connections handled by the submission-login process will be terminated. The crashes can cause failure for user to send a message, or it can cause duplica te messages to be sent. If TLS is not used (in the backend server processing the submission), duplicate deliveries cannot happen, because the crash can only happen at AUT H stage. No publicly available exploits are known. Solution: Limit the number of connections handled by single submission-login process. This has a performance impact though. Update to non-vulnerable version. --- Internal reference: DOV-8874 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <3.0.7, OX Dovecot Pro core >=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-03-11 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: ylwango613@yeswehack CVE: CVE-2026-33607 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Details: Dovecot IMAP LIST match_sub() Exponential Backtracking — CPU Denial of Service. An attacker that has valid credentials can use IMAP LIST command to consume CPU. Risk: This can cause degradation or denial of service for IMAP. No publicly available exploits are known. Solution: Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. --- Internal reference: DOV-8884 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core =3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-03-13 Solution date: 2026-08-26 Disclosure date: 2026-08-26 CVE: CVE-2026-27852 CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Details: DoS by sending mail with bad header. An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME par ameters, which causes excessive memory usage when the message is later parsed. Risk: The message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, causing denial of service for the affected user. No publicly available exploits are known. Solution: Update to non-vulnerable version. --- Internal reference: DOV-8941 Type: CWE-93 (Improper Neutralization of CRLF Sequences ('CRLF Injection')) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core =3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-03-24 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: thanos_haruki@yeswehack CVE: CVE-2026-33606 CVSS: 4.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N) Details: dsync: Mail content can cause dsync protocol injection. Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administ rator later runs dsync with the stream protocol, for example during a migration. Risk: Injected commands can modify mailbox state on the destination during migration or replication, including internal mailbox attributes that a user should not be able to set directly. It can also cause dsync errors. No publicly available exploits are known. Solution: Avoid running dsync with the stream protocol on mailboxes with untrusted content. Update to non-vulnerable version. --- Internal reference: DOV-8947 Type: CWE-655 (Insufficient Psychological Acceptability) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core =3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-03-24 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: heckintosh@yeswehack CVE: CVE-2026-33604 CVSS: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Details: SMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return. An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. Risk: A downstream mail server that hasn't yet fixed the SMTP smuggling vulnerability can be tricked into treating part of the message body as new SMTP commands, allowing injec tion of spoofed email. This is the same vulnerability class as CVE-2023-51764 and CVE-2023-51766. No publicly available exploits are known. Solution: Where you control the receiving mail servers, ensure they reject bare carriage returns in message data. Update to non-vulnerable version. --- Internal reference: DOV-8949 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core =3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-03-24 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: djvirus@yeswehack CVE: CVE-2026-40014 CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Details: IMAP THREAD REFERENCES O(N²) CPU DoS via Crafted References Header (index-thread-links.c). An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. Risk: When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. No publicly available exploits are known. Solution: Monitor system for abnormal CPU usage, kill the offending process and remove the offending message from the affected mailbox. Update to non-vulnerable version. --- Internal reference: DOV-8991 Type: CWE-124 (Buffer Underwrite ('Buffer Underflow')) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core =3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-04-02 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: ilyar@yeswehack CVE: CVE-2026-40013 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Details: pigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT. An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script. Risk: This causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of service for script management. This might be able to be used for re mote code execution. No publicly available exploits are known. Solution: Disable the ManageSieve service if users do not need remote Sieve script management. Update to non-vulnerable version. --- Internal reference: DOV-8994 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core =3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-04-02 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: ilyar@yeswehack CVE: CVE-2026-33605 CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Details: managesieve-login: Pre-auth crash. An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. Risk: If running in high-security mode (default for community releases), only the attacker's own connection is terminated. If running in high-performance mode (default for Pro releases), all connections handled by the same managesieve-login process are terminated. Repeating the attack can cause denial of service for Sieve script management. No publicly available exploits are known. Solution: Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. --- Internal reference: DOV-9039 Type: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot Pro core >=2.3.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5 First fixed revision: OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5 Discovery date: 2026-04-08 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: tipsennn@yeswehack CVE: CVE-2026-40018 CVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Details: MySQL multi-byte escaping wrong. None Risk: None No publicly available exploits are known. Solution: None --- Internal reference: DOV-9041 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Affected versions: OX Dovecot CE core >=2.4.3 <2.4.5 First fixed revision: OX Dovecot CE core 2.4.5 Discovery date: 2026-04-08 Solution date: 2026-08-26 Disclosure date: 2026-08-26 Researcher credits: ilyar@yeswehack CVE: CVE-2026-4
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Credits
    Aki Tuomi
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Security Advisory",
          "vendor": "Dovecot",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aki Tuomi"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hi!\n\nWe\u0027re sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those \nvulnerabilities. This advisory will also be published at \nhttps://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html\n\n---\n\nClassification: TLP:GREEN\n\nInternal reference: DOV-8476\nType: CWE-403 (Exposure of File Descriptor to Unintended Control Sphere (\u0027File Descriptor Leak\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2025-11-25\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nCVE: CVE-2026-33263\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nsubmission-login: Panic when mail_max_userip_connections is reached: Panic: epoll_ctl(del, 8) failed: Bad file \ndescriptor. When mail_max_userip_connections is set (defaul\nt 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues.\n\nRisk:\nIf running in high-security mode (default for community releases), only the new submission connection gets terminated. \nIf running in high-performance mode (default for Pr\no releases), all connections handled by the submission-login process will be terminated. The crashes can cause failure \nfor user to send a message, or it can cause duplica\nte messages to be sent. If TLS is not used (in the backend server processing the submission), duplicate deliveries \ncannot happen, because the crash can only happen at AUT\nH stage. No publicly available exploits are known.\n\nSolution:\nLimit the number of connections handled by single submission-login process. This has a performance impact though. \nUpdate to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8874\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c3.0.7, OX Dovecot Pro core \u003e=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \n\u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5\nDiscovery date: 2026-03-11\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ylwango613@yeswehack\nCVE: CVE-2026-33607\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nDovecot IMAP LIST match_sub() Exponential Backtracking \u2014 CPU Denial of Service. An attacker that has valid credentials \ncan use IMAP LIST command to consume CPU.\n\nRisk:\nThis can cause degradation or denial of service for IMAP. No publicly available exploits are known.\n\nSolution:\nMonitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed \nversion.\n\n\n\n---\n\n\n\nInternal reference: DOV-8884\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-13\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nCVE: CVE-2026-27852\nCVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nDetails:\nDoS by sending mail with bad header. An attacker that can send mail to a user can craft a message whose headers contain \na very large number of email addresses or MIME par\nameters, which causes excessive memory usage when the message is later parsed.\n\nRisk:\nThe message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, \ncausing denial of service for the affected user. No\n publicly available exploits are known.\n\nSolution:\nUpdate to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8941\nType: CWE-93 (Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-24\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: thanos_haruki@yeswehack\nCVE: CVE-2026-33606\nCVSS: 4.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N)\n\nDetails:\ndsync: Mail content can cause dsync protocol injection. Mail content stored by a user can be crafted so that it is \ninterpreted as dsync protocol commands when an administ\nrator later runs dsync with the stream protocol, for example during a migration.\n\nRisk:\nInjected commands can modify mailbox state on the destination during migration or replication, including internal \nmailbox attributes that a user should not be able to set\n directly. It can also cause dsync errors. No publicly available exploits are known.\n\nSolution:\nAvoid running dsync with the stream protocol on mailboxes with untrusted content. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8947\nType: CWE-655 (Insufficient Psychological Acceptability)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-24\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: heckintosh@yeswehack\nCVE: CVE-2026-33604\nCVSS: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)\n\nDetails:\nSMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return. An attacker that can get Dovecot to relay a \nmessage, for example through Sieve redirect or submission \nrelay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message \ncontent from being interpreted as SMTP commands.\n\nRisk:\nA downstream mail server that hasn\u0027t yet fixed the SMTP smuggling vulnerability can be tricked into treating part of \nthe message body as new SMTP commands, allowing injec\ntion of spoofed email. This is the same vulnerability class as CVE-2023-51764 and CVE-2023-51766. No publicly available \nexploits are known.\n\nSolution:\nWhere you control the receiving mail servers, ensure they reject bare carriage returns in message data. Update to \nnon-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8949\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-24\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: djvirus@yeswehack\nCVE: CVE-2026-40014\nCVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)\n\nDetails:\nIMAP THREAD REFERENCES O(N\u00b2) CPU DoS via Crafted References Header (index-thread-links.c). An attacker that can send \nmail to a user can craft a message header that makes \nthe IMAP THREAD command consume CPU disproportionate to the size of the message.\n\nRisk:\nWhen a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for \nIMAP. No publicly available exploits are known.\n\nSolution:\nMonitor system for abnormal CPU usage, kill the offending process and remove the offending message from the affected \nmailbox. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8991\nType: CWE-124 (Buffer Underwrite (\u0027Buffer Underflow\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-04-02\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ilyar@yeswehack\nCVE: CVE-2026-40013\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\npigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT. An attacker that has valid \ncredentials can submit a Sieve script containing an extreme\n numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script.\n\nRisk:\nThis causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of service for \nscript management. This might be able to be used for re\nmote code execution. No publicly available exploits are known.\n\nSolution:\nDisable the ManageSieve service if users do not need remote Sieve script management. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8994\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-04-02\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ilyar@yeswehack\nCVE: CVE-2026-33605\nCVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nDetails:\nmanagesieve-login: Pre-auth crash. An unauthenticated attacker can crash the ManageSieve login process by sending a \nsmall malformed command before authenticating.\n\nRisk:\nIf running in high-security mode (default for community releases), only the attacker\u0027s own connection is terminated. If \nrunning in high-performance mode (default for Pro \nreleases), all connections handled by the same managesieve-login process are terminated. Repeating the attack can cause \ndenial of service for Sieve script management. No \npublicly available exploits are known.\n\nSolution:\nRestrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-9039\nType: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5\nDiscovery date: 2026-04-08\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: tipsennn@yeswehack\nCVE: CVE-2026-40018\nCVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)\n\nDetails:\nMySQL multi-byte escaping wrong. None\n\nRisk:\nNone No publicly available exploits are known.\n\nSolution:\nNone\n\n\n\n---\n\n\n\nInternal reference: DOV-9041\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot CE core \u003e=2.4.3 \u003c2.4.5\nFirst fixed revision: OX Dovecot CE core 2.4.5\nDiscovery date: 2026-04-08\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ilyar@yeswehack\nCVE: CVE-2026-4"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1050",
              "description": "CWE-1050",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-124",
              "description": "CWE-124",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-125",
              "description": "CWE-125",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-200",
              "description": "CWE-200",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-284",
              "description": "CWE-284",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-287",
              "description": "CWE-287",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-403",
              "description": "CWE-403",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-416",
              "description": "CWE-416",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-655",
              "description": "CWE-655",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-674",
              "description": "CWE-674",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-93",
              "description": "CWE-93",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:55:52Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/116"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/116"
        },
        {
          "url": "https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/116"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Dovecot Security Advisory 3/2026",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0020",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/116",
            "automated": true,
            "contentSha256": "01aaf8800660f758cbc04e020b53167b1553f36c4c558df09e8389481ca8dfa0",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/116",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-28T10:07:32Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:20Z",
    "dateUpdated": "2026-09-11T11:55:52Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0020"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}