Skip to main content

OX Dovecot Pro CVE-2026-27851

| EUVDEUVD-2026-29467 CRITICAL
Improper Handling of Extra Parameters (CWE-235)
2026-05-12 OX GHSA-xfpv-rrgm-4qqr
Code Injection Ox Dovecot Pro
9.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI
9.1 CRITICAL

Pre-auth injection in the login path gives AV:N/PR:N/UI:N; AC:L since no attacker-side hurdle (config dependency is server-side, not an attack condition); C:H/I:H for auth bypass/data access, A:N as no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat
7.4 HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

7
Analysis Updated
Jun 30, 2026 - 03:33 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 03:33 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 30, 2026 - 03:24 vuln.today
cvss_changed
Severity Changed
Jun 30, 2026 - 03:24 NVD
HIGH CRITICAL
CVSS changed
Jun 30, 2026 - 03:24 NVD
7.4 (HIGH) 9.1 (CRITICAL)
Analysis Generated
May 12, 2026 - 14:15 vuln.today
CVE Published
May 12, 2026 - 13:28 nvd
HIGH 7.4

DescriptionNVD

When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.

AnalysisAI

Authentication-layer injection in OX Dovecot Pro (versions up to and including 2.4.3 and 3.1.4) arises from a flaw in the 'safe' template filter: when 'safe' is applied during variable expansion, every subsequent pipeline stage on the same string inherits the 'safe' designation, so attacker-controlled data that should be escaped is passed through unescaped. Because variable expansion is used to build authentication backend queries, this enables SQL or LDAP injection by remote unauthenticated attackers. There is no public exploit identified at time of analysis, and EPSS exploitation probability is negligible (0.01%, 2nd percentile).

Technical ContextAI

Dovecot is a widely-used IMAP/POP3 mail server; OX Dovecot Pro is Open-Xchange's supported enterprise distribution (CPE cpe:2.3:a:open-xchange_gmbh:ox_dovecot_pro). Dovecot's configuration uses a variable-expansion/templating syntax where filters can be chained in pipelines (e.g. %{variable | filter | filter}). The 'safe' filter is meant to mark a single value as already neutralized for a given context (such as SQL or LDAP query construction). The defect is a state-tracking error: once 'safe' is encountered, the 'safe' flag is not reset for following filters/pipelines operating on the same string, so escaping that should occur downstream is skipped. The assigned CWE-235 (Improper Handling of Extra Parameters) points to the parser/expansion logic mishandling subsequent pipeline elements; the practical consequence is an injection class flaw (the tags label it 'Code Injection') when this expansion feeds userdb/passdb SQL or LDAP lookups during login.

RemediationAI

Patch available per vendor advisory: upgrade OX Dovecot Pro to a fixed release above the affected 2.4.3 and 3.1.4 branches as specified in Open-Xchange advisory oxdc-adv-2026-0002 (https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json); the exact fixed version numbers should be taken directly from that advisory and the matching distro notices (Ubuntu USN-8365-1, Red Hat CSAF VEX) rather than assumed. As an explicit interim workaround the vendor recommends avoiding use of the 'safe' filter until on a fixed version - review passdb/userdb and any auth-related variable-expansion configuration and remove or rewrite pipelines that rely on 'safe' for SQL/LDAP escaping, substituting backend-native parameterization or known-good escaping; the trade-off is that auth query templates may need rework and testing to preserve correct login behavior. Where immediate config changes are not feasible, restrict and monitor authentication inputs and prioritize the upgrade.

More in Ox Dovecot Pro

View all
CVE-2026-42007 CRITICAL
9.1 Aug 28

Use-after-free in the OX Dovecot Pro and Dovecot CE mail-editing code lets an authenticated user who can install a Sieve
CVE-2026-24031 HIGH
8.2 Mar 27

Authentication bypass and user enumeration in OX Dovecot Pro (versions up to and including 3.1.0 and the 2.4.x line up t
CVE-2025-59032 HIGH
7.5 Mar 27

OX Dovecot Pro ManageSieve service crashes when processing AUTHENTICATE commands with SASL initial responses using liter
CVE-2026-27858 HIGH
7.5 Mar 27

OX Dovecot Pro managesieve-login process crashes repeatedly due to memory exhaustion triggered by unauthenticated attack
CVE-2026-27857 HIGH
7.5 Mar 27

Remote memory-exhaustion denial of service in OX Dovecot Pro (versions up to and including 2.3.0) lets an unauthenticate
CVE-2026-42391 HIGH
7.5 Aug 28

Denial of service in OX Dovecot Pro and OX Dovecot CE allows unauthenticated remote attackers to exhaust memory and CPU

CVE-2026-33605 HIGH
7.5 Aug 28

ManageSieve login process in OX Dovecot CE and Pro crashes on receipt of a small malformed pre-authentication command, e
CVE-2026-27852 HIGH
7.5 Aug 28

Memory exhaustion in OX Dovecot Pro and OX Dovecot CE allows any remote sender to deny IMAP service to a targeted user b
CVE-2026-73208 HIGH
7.4 Aug 28

OAuth2 token validation in OX Dovecot Pro and OX Dovecot CE contains a logic error that permits authentication bypass wh
CVE-2026-40018 HIGH
7.4 Aug 28

SQL injection in Open-Xchange OX Dovecot Pro and OX Dovecot CE enables unauthenticated remote attackers, under high-comp
CVE-2026-73209 MEDIUM
6.5 Aug 28

Stack exhaustion via crafted compressed IMAP data in OX Dovecot Pro and OX Dovecot CE allows an authenticated remote att
CVE-2026-52687 MEDIUM
6.5 Aug 28

IMAP compression in OX Dovecot Pro and OX Dovecot CE allows any authenticated user to exhaust the memory of the imap-log

Same weakness CWE-235 – Improper Handling of Extra Parameters

View all
CVE-2024-47651 HIGH
7.1
CVE-2026-20083 MEDIUM
6.5

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed

Share

CVE-2026-27851 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy