GCVE-1988-2026-0020
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-09 10:12
VLAI
EPSS
VEX
Title
Dovecot Security Advisory 3/2026
Summary
Hi!
We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those
vulnerabilities. This advisory will also be published at
https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html
---
Classification: TLP:GREEN
Internal reference: DOV-8476
Type: CWE-403 (Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak'))
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core
=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5
First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE
core 2.4.5
Discovery date: 2025-11-25
Solution date: 2026-08-26
Disclosure date: 2026-08-26
CVE: CVE-2026-33263
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Details:
submission-login: Panic when mail_max_userip_connections is reached: Panic: epoll_ctl(del, 8) failed: Bad file
descriptor. When mail_max_userip_connections is set (defaul
t 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues.
Risk:
If running in high-security mode (default for community releases), only the new submission connection gets terminated.
If running in high-performance mode (default for Pr
o releases), all connections handled by the submission-login process will be terminated. The crashes can cause failure
for user to send a message, or it can cause duplica
te messages to be sent. If TLS is not used (in the backend server processing the submission), duplicate deliveries
cannot happen, because the crash can only happen at AUT
H stage. No publicly available exploits are known.
Solution:
Limit the number of connections handled by single submission-login process. This has a performance impact though.
Update to non-vulnerable version.
---
Internal reference: DOV-8874
Type: CWE-400 (Uncontrolled Resource Consumption)
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Affected versions: OX Dovecot Pro core >=2.3.0 <3.0.7, OX Dovecot Pro core >=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0
<2.4.5
First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5
Discovery date: 2026-03-11
Solution date: 2026-08-26
Disclosure date: 2026-08-26
Researcher credits: ylwango613@yeswehack
CVE: CVE-2026-33607
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Details:
Dovecot IMAP LIST match_sub() Exponential Backtracking — CPU Denial of Service. An attacker that has valid credentials
can use IMAP LIST command to consume CPU.
Risk:
This can cause degradation or denial of service for IMAP. No publicly available exploits are known.
Solution:
Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed
version.
---
Internal reference: DOV-8884
Type: CWE-400 (Uncontrolled Resource Consumption)
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core
=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5
First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE
core 2.4.5
Discovery date: 2026-03-13
Solution date: 2026-08-26
Disclosure date: 2026-08-26
CVE: CVE-2026-27852
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Details:
DoS by sending mail with bad header. An attacker that can send mail to a user can craft a message whose headers contain
a very large number of email addresses or MIME par
ameters, which causes excessive memory usage when the message is later parsed.
Risk:
The message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it,
causing denial of service for the affected user. No
publicly available exploits are known.
Solution:
Update to non-vulnerable version.
---
Internal reference: DOV-8941
Type: CWE-93 (Improper Neutralization of CRLF Sequences ('CRLF Injection'))
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core
=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5
First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE
core 2.4.5
Discovery date: 2026-03-24
Solution date: 2026-08-26
Disclosure date: 2026-08-26
Researcher credits: thanos_haruki@yeswehack
CVE: CVE-2026-33606
CVSS: 4.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N)
Details:
dsync: Mail content can cause dsync protocol injection. Mail content stored by a user can be crafted so that it is
interpreted as dsync protocol commands when an administ
rator later runs dsync with the stream protocol, for example during a migration.
Risk:
Injected commands can modify mailbox state on the destination during migration or replication, including internal
mailbox attributes that a user should not be able to set
directly. It can also cause dsync errors. No publicly available exploits are known.
Solution:
Avoid running dsync with the stream protocol on mailboxes with untrusted content. Update to non-vulnerable version.
---
Internal reference: DOV-8947
Type: CWE-655 (Insufficient Psychological Acceptability)
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core
=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5
First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE
core 2.4.5
Discovery date: 2026-03-24
Solution date: 2026-08-26
Disclosure date: 2026-08-26
Researcher credits: heckintosh@yeswehack
CVE: CVE-2026-33604
CVSS: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Details:
SMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return. An attacker that can get Dovecot to relay a
message, for example through Sieve redirect or submission
relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message
content from being interpreted as SMTP commands.
Risk:
A downstream mail server that hasn't yet fixed the SMTP smuggling vulnerability can be tricked into treating part of
the message body as new SMTP commands, allowing injec
tion of spoofed email. This is the same vulnerability class as CVE-2023-51764 and CVE-2023-51766. No publicly available
exploits are known.
Solution:
Where you control the receiving mail servers, ensure they reject bare carriage returns in message data. Update to
non-vulnerable version.
---
Internal reference: DOV-8949
Type: CWE-400 (Uncontrolled Resource Consumption)
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core
=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5
First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE
core 2.4.5
Discovery date: 2026-03-24
Solution date: 2026-08-26
Disclosure date: 2026-08-26
Researcher credits: djvirus@yeswehack
CVE: CVE-2026-40014
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Details:
IMAP THREAD REFERENCES O(N²) CPU DoS via Crafted References Header (index-thread-links.c). An attacker that can send
mail to a user can craft a message header that makes
the IMAP THREAD command consume CPU disproportionate to the size of the message.
Risk:
When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for
IMAP. No publicly available exploits are known.
Solution:
Monitor system for abnormal CPU usage, kill the offending process and remove the offending message from the affected
mailbox. Update to non-vulnerable version.
---
Internal reference: DOV-8991
Type: CWE-124 (Buffer Underwrite ('Buffer Underflow'))
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core
=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5
First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE
core 2.4.5
Discovery date: 2026-04-02
Solution date: 2026-08-26
Disclosure date: 2026-08-26
Researcher credits: ilyar@yeswehack
CVE: CVE-2026-40013
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Details:
pigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT. An attacker that has valid
credentials can submit a Sieve script containing an extreme
numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script.
Risk:
This causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of service for
script management. This might be able to be used for re
mote code execution. No publicly available exploits are known.
Solution:
Disable the ManageSieve service if users do not need remote Sieve script management. Update to non-vulnerable version.
---
Internal reference: DOV-8994
Type: CWE-400 (Uncontrolled Resource Consumption)
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Affected versions: OX Dovecot Pro core >=2.3.0 <2.3.22.2, OX Dovecot Pro core >=3.0.0 <3.0.7, OX Dovecot Pro core
=3.1.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5
First fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE
core 2.4.5
Discovery date: 2026-04-02
Solution date: 2026-08-26
Disclosure date: 2026-08-26
Researcher credits: ilyar@yeswehack
CVE: CVE-2026-33605
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Details:
managesieve-login: Pre-auth crash. An unauthenticated attacker can crash the ManageSieve login process by sending a
small malformed command before authenticating.
Risk:
If running in high-security mode (default for community releases), only the attacker's own connection is terminated. If
running in high-performance mode (default for Pro
releases), all connections handled by the same managesieve-login process are terminated. Repeating the attack can cause
denial of service for Sieve script management. No
publicly available exploits are known.
Solution:
Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version.
---
Internal reference: DOV-9039
Type: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Affected versions: OX Dovecot Pro core >=2.3.0 <3.1.6, OX Dovecot CE core >=2.3.0 <2.4.5
First fixed revision: OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5
Discovery date: 2026-04-08
Solution date: 2026-08-26
Disclosure date: 2026-08-26
Researcher credits: tipsennn@yeswehack
CVE: CVE-2026-40018
CVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Details:
MySQL multi-byte escaping wrong. None
Risk:
None No publicly available exploits are known.
Solution:
None
---
Internal reference: DOV-9041
Type: CWE-400 (Uncontrolled Resource Consumption)
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Affected versions: OX Dovecot CE core >=2.4.3 <2.4.5
First fixed revision: OX Dovecot CE core 2.4.5
Discovery date: 2026-04-08
Solution date: 2026-08-26
Disclosure date: 2026-08-26
Researcher credits: ilyar@yeswehack
CVE: CVE-2026-4
Severity
No CVSS data available.
CWE
Assigner
References
5 references
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Dovecot | Dovecot Security Advisory |
Affected:
unknown
|
guessed |
{
"containers": {
"cna": {
"affected": [
{
"product": "Dovecot Security Advisory",
"vendor": "Dovecot",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Aki Tuomi"
}
],
"descriptions": [
{
"lang": "en",
"value": "Hi!\n\nWe\u0027re sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those \nvulnerabilities. This advisory will also be published at \nhttps://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html\n\n---\n\nClassification: TLP:GREEN\n\nInternal reference: DOV-8476\nType: CWE-403 (Exposure of File Descriptor to Unintended Control Sphere (\u0027File Descriptor Leak\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2025-11-25\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nCVE: CVE-2026-33263\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nsubmission-login: Panic when mail_max_userip_connections is reached: Panic: epoll_ctl(del, 8) failed: Bad file \ndescriptor. When mail_max_userip_connections is set (defaul\nt 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues.\n\nRisk:\nIf running in high-security mode (default for community releases), only the new submission connection gets terminated. \nIf running in high-performance mode (default for Pr\no releases), all connections handled by the submission-login process will be terminated. The crashes can cause failure \nfor user to send a message, or it can cause duplica\nte messages to be sent. If TLS is not used (in the backend server processing the submission), duplicate deliveries \ncannot happen, because the crash can only happen at AUT\nH stage. No publicly available exploits are known.\n\nSolution:\nLimit the number of connections handled by single submission-login process. This has a performance impact though. \nUpdate to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8874\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c3.0.7, OX Dovecot Pro core \u003e=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \n\u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5\nDiscovery date: 2026-03-11\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ylwango613@yeswehack\nCVE: CVE-2026-33607\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nDovecot IMAP LIST match_sub() Exponential Backtracking \u2014 CPU Denial of Service. An attacker that has valid credentials \ncan use IMAP LIST command to consume CPU.\n\nRisk:\nThis can cause degradation or denial of service for IMAP. No publicly available exploits are known.\n\nSolution:\nMonitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed \nversion.\n\n\n\n---\n\n\n\nInternal reference: DOV-8884\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-13\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nCVE: CVE-2026-27852\nCVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nDetails:\nDoS by sending mail with bad header. An attacker that can send mail to a user can craft a message whose headers contain \na very large number of email addresses or MIME par\nameters, which causes excessive memory usage when the message is later parsed.\n\nRisk:\nThe message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, \ncausing denial of service for the affected user. No\n publicly available exploits are known.\n\nSolution:\nUpdate to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8941\nType: CWE-93 (Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-24\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: thanos_haruki@yeswehack\nCVE: CVE-2026-33606\nCVSS: 4.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N)\n\nDetails:\ndsync: Mail content can cause dsync protocol injection. Mail content stored by a user can be crafted so that it is \ninterpreted as dsync protocol commands when an administ\nrator later runs dsync with the stream protocol, for example during a migration.\n\nRisk:\nInjected commands can modify mailbox state on the destination during migration or replication, including internal \nmailbox attributes that a user should not be able to set\n directly. It can also cause dsync errors. No publicly available exploits are known.\n\nSolution:\nAvoid running dsync with the stream protocol on mailboxes with untrusted content. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8947\nType: CWE-655 (Insufficient Psychological Acceptability)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-24\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: heckintosh@yeswehack\nCVE: CVE-2026-33604\nCVSS: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)\n\nDetails:\nSMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return. An attacker that can get Dovecot to relay a \nmessage, for example through Sieve redirect or submission \nrelay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message \ncontent from being interpreted as SMTP commands.\n\nRisk:\nA downstream mail server that hasn\u0027t yet fixed the SMTP smuggling vulnerability can be tricked into treating part of \nthe message body as new SMTP commands, allowing injec\ntion of spoofed email. This is the same vulnerability class as CVE-2023-51764 and CVE-2023-51766. No publicly available \nexploits are known.\n\nSolution:\nWhere you control the receiving mail servers, ensure they reject bare carriage returns in message data. Update to \nnon-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8949\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-24\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: djvirus@yeswehack\nCVE: CVE-2026-40014\nCVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)\n\nDetails:\nIMAP THREAD REFERENCES O(N\u00b2) CPU DoS via Crafted References Header (index-thread-links.c). An attacker that can send \nmail to a user can craft a message header that makes \nthe IMAP THREAD command consume CPU disproportionate to the size of the message.\n\nRisk:\nWhen a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for \nIMAP. No publicly available exploits are known.\n\nSolution:\nMonitor system for abnormal CPU usage, kill the offending process and remove the offending message from the affected \nmailbox. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8991\nType: CWE-124 (Buffer Underwrite (\u0027Buffer Underflow\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-04-02\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ilyar@yeswehack\nCVE: CVE-2026-40013\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\npigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT. An attacker that has valid \ncredentials can submit a Sieve script containing an extreme\n numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script.\n\nRisk:\nThis causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of service for \nscript management. This might be able to be used for re\nmote code execution. No publicly available exploits are known.\n\nSolution:\nDisable the ManageSieve service if users do not need remote Sieve script management. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8994\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-04-02\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ilyar@yeswehack\nCVE: CVE-2026-33605\nCVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nDetails:\nmanagesieve-login: Pre-auth crash. An unauthenticated attacker can crash the ManageSieve login process by sending a \nsmall malformed command before authenticating.\n\nRisk:\nIf running in high-security mode (default for community releases), only the attacker\u0027s own connection is terminated. If \nrunning in high-performance mode (default for Pro \nreleases), all connections handled by the same managesieve-login process are terminated. Repeating the attack can cause \ndenial of service for Sieve script management. No \npublicly available exploits are known.\n\nSolution:\nRestrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-9039\nType: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5\nDiscovery date: 2026-04-08\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: tipsennn@yeswehack\nCVE: CVE-2026-40018\nCVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)\n\nDetails:\nMySQL multi-byte escaping wrong. None\n\nRisk:\nNone No publicly available exploits are known.\n\nSolution:\nNone\n\n\n\n---\n\n\n\nInternal reference: DOV-9041\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot CE core \u003e=2.4.3 \u003c2.4.5\nFirst fixed revision: OX Dovecot CE core 2.4.5\nDiscovery date: 2026-04-08\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ilyar@yeswehack\nCVE: CVE-2026-4"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1050",
"description": "CWE-1050",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-124",
"description": "CWE-124",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-125",
"description": "CWE-125",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-284",
"description": "CWE-284",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-287",
"description": "CWE-287",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-400",
"description": "CWE-400",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-403",
"description": "CWE-403",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-416",
"description": "CWE-416",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-655",
"description": "CWE-655",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-674",
"description": "CWE-674",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-89",
"description": "CWE-89",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-93",
"description": "CWE-93",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:12:01Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/116"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/116"
},
{
"url": "https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/116"
],
"discovery": "EXTERNAL"
},
"title": "Dovecot Security Advisory 3/2026",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0020",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/116",
"automated": true,
"contentSha256": "01aaf8800660f758cbc04e020b53167b1553f36c4c558df09e8389481ca8dfa0",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/116",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-28T10:07:32Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:20Z",
"dateUpdated": "2026-09-09T10:12:01Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0020"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…