OXDC-ADV-2026-0002
Metadata
- Document type: OX Dovecot Security Advisory
- Publisher: Open-Xchange GmbH
- Classification: TLP:GREEN
- Publication Date: 2026-05-05
- Current version: 3
- Version status: Final
- Aggregate severity: High
References
Vulnerabilities
CVE-2026-27851: lib-var-expand: Safe filter leaks to all following pipelines
- CVE reference: CVE-2026-27851
- Internal reference: DOV-8967
- CWE: CWE-235 (Improper Handling of Extra Parameters)
- Discovery date: 2026-03-29
- Researcher credits: caprinuxx@yeswehack
Description
When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped.
Product status
Last affected
| Products | CVSS-Vector | CVSS Base Score |
|---|---|---|
| OX Dovecot Pro core 3.1.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N | 7.4 |
| OX Dovecot Pro core 2.4.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N | 7.4 |
Threats
Impact
This can enable SQL / LDAP injection attacks when used in authentication.
Exploit status
No publicly available exploits are known.
Remediation
Vendor fix (2026-05-05)
For products
- OX Dovecot Pro core 3.1.5
- OX Dovecot Pro core 2.4.4
Avoid using safe filter until on fixed version.
CVE-2026-40016: Sieve :contains/:matches O(N×M) Substring Match Bypasses sieve_max_cpu_time Limit (130× Overrun)
- CVE reference: CVE-2026-40016
- Internal reference: DOV-8948
- CWE: CWE-400 (Uncontrolled Resource Consumption)
- Discovery date: 2026-03-24
- Researcher credits: djvirus@yeswehack
Description
Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the configured limit.
Product status
Last affected
| Products | CVSS-Vector | CVSS Base Score |
|---|---|---|
| OX Dovecot Pro core 2.3.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H | 5.3 |
Threats
Impact
Attacker can use this to degrade server performance and bypass configured CPU time limits for Sieve scripts.
Exploit status
No publicly available exploits are known.
Remediation
Vendor fix (2026-05-05)
For products
- OX Dovecot Pro core 3.1.5
- OX Dovecot Pro core 2.4.4
Install fixed version, or alternatively prevent direct access to Sieve scripts via ManageSieve or local access.
CVE-2026-33603: login: Base64 input can contain tabs that bypass IPC protection
- CVE reference: CVE-2026-33603
- Internal reference: DOV-9030
- CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
- Discovery date: 2026-04-08
- Researcher credits: ylwango613@yeswehack
Description
Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to position itself between Dovecot and the client connection.
Product status
Last affected
| Products | CVSS-Vector | CVSS Base Score |
|---|---|---|
| OX Dovecot Pro core 3.1.0 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N | 6.8 |
| OX Dovecot Pro core 2.4.0 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N | 6.8 |
Threats
Impact
If successful, the attacker can eavesdrop communications between Dovecot and client as MITM proxy.
Exploit status
No publicly available exploits are known.
Remediation
Vendor fix (2026-05-05)
For products
- OX Dovecot Pro core 3.1.5
- OX Dovecot Pro core 2.4.4
Install fixed version.
CVE-2026-40020: IMAP folders can be shared-spammed to everyone
- CVE reference: CVE-2026-40020
- Internal reference: DOV-9040
- CWE: CWE-284 (Improper Access Control)
- Discovery date: 2026-04-08
- Researcher credits: ilhamaf@yeswehack
Description
Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be spammed to all users.
Product status
Last affected
| Products | CVSS-Vector | CVSS Base Score |
|---|---|---|
| OX Dovecot Pro core 2.3.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L | 3.1 |
Threats
Impact
The impact is limited to being able to spam folders to other users, no unexpected access is gained.
Exploit status
No publicly available exploits are known.
Remediation
Vendor fix (2026-05-05)
For products
- OX Dovecot Pro core 3.1.5
- OX Dovecot Pro core 2.4.4
Install to fixed version.
CVE-2026-42006: imap-login: Excessive memory usage DoS - Try 2
- CVE reference: CVE-2026-42006
- Internal reference: DOV-9138
- CWE: CWE-400 (Uncontrolled Resource Consumption)
- Discovery date: 2026-04-27
- Researcher credits: D4RKCYPH3R@yeswehack
Description
An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit.
Product status
Last affected
| Products | CVSS-Vector | CVSS Base Score |
|---|---|---|
| OX Dovecot Pro core 3.0.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L | 4.3 |
| OX Dovecot Pro core 3.1.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L | 4.3 |
| OX Dovecot Pro core 2.4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L | 4.3 |
Threats
Impact
Using excessive bracing, attacker can cause memory usage up to configured memory limit.
Exploit status
No publicly available exploits are known.
Remediation
Vendor fix (2026-05-05)
For products
- OX Dovecot Pro core 3.1.5
- OX Dovecot Pro core 2.4.4
Install fixed version, or configure vsz_limit for imap process to low value.