Skip to main content

OX Dovecot Pro CVE-2026-33603

| EUVDEUVD-2026-29468 MEDIUM
Improper Control of Resource Identifiers ('Resource Injection') (CWE-99)
2026-05-12 OX GHSA-gxj9-f8v6-q8h3
Information Disclosure Microsoft Red Hat Suse Ox Dovecot Pro Open Xchange Gmbh
6.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.8 MEDIUM
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
SUSE
MEDIUM
qualitative
Red Hat
6.8 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

2
Analysis Generated
May 12, 2026 - 14:16 vuln.today
CVE Published
May 12, 2026 - 13:28 nvd
MEDIUM 6.8

DescriptionCVE.org

Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to position itself between Dovecot and the client connection. If successful, the attacker can eavesdrop communications between Dovecot and client as MITM proxy. Install fixed version. No publicly available exploits are known.

AnalysisAI

Man-in-the-middle attackers positioned between OX Dovecot Pro and clients can forge SCRAM TLS channel binding via specially crafted base64 exchanges, allowing eavesdropping on encrypted communications. The attack requires network-level access and knowledge of channel binding mechanics but yields complete confidentiality compromise. No public exploit code is known, and patched versions are available from Open-Xchange.

Technical ContextAI

SCRAM (Salted Challenge Response Authentication Mechanism) with TLS channel binding is an authentication protocol that binds the SASL authentication to the underlying TLS session to prevent credential relay and MITM attacks. Channel binding embeds proof of the TLS connection into the authentication exchange; the vulnerability allows attackers to forge or replay this binding by manipulating base64-encoded SCRAM messages. CWE-99 (Improper Control of Resource Identifiers) suggests the vulnerability stems from inadequate validation or verification of channel binding data structures. OX Dovecot Pro is the commercial variant of Dovecot, a widely-used IMAP/POP3 mail server.

RemediationAI

Upgrade OX Dovecot Pro to the patched version specified in Open-Xchange advisory OXDC-ADV-2026-0002 (consult https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json for exact version and timing). If immediate patching is not feasible, implement compensating controls: restrict SCRAM authentication to internal, trusted networks only by using firewall rules or Dovecot ACLs to block external SCRAM connections; alternatively, enforce certificate pinning or mutual TLS authentication to prevent MITM positioning. Both workarounds degrade user experience (e.g., external mail clients may fail) and do not address the root cause, making patching the primary remediation path.

More in Ox Dovecot Pro

View all
CVE-2026-42007 CRITICAL
9.1 Aug 28

Use-after-free in the OX Dovecot Pro and Dovecot CE mail-editing code lets an authenticated user who can install a Sieve
CVE-2026-27851 CRITICAL
9.1 May 12

Authentication-layer injection in OX Dovecot Pro (versions up to and including 2.4.3 and 3.1.4) arises from a flaw in th
CVE-2026-24031 HIGH
8.2 Mar 27

Authentication bypass and user enumeration in OX Dovecot Pro (versions up to and including 3.1.0 and the 2.4.x line up t
CVE-2026-27860 LOW POC
3.7 Mar 27

Open-Xchange Dovecot Pro contains an LDAP filter injection vulnerability in its authentication module that allows remote
CVE-2026-42391 HIGH
7.5 Aug 28

Denial of service in OX Dovecot Pro and OX Dovecot CE allows unauthenticated remote attackers to exhaust memory and CPU

CVE-2026-33605 HIGH
7.5 Aug 28

ManageSieve login process in OX Dovecot CE and Pro crashes on receipt of a small malformed pre-authentication command, e
CVE-2026-27852 HIGH
7.5 Aug 28

Memory exhaustion in OX Dovecot Pro and OX Dovecot CE allows any remote sender to deny IMAP service to a targeted user b
CVE-2025-59032 HIGH
7.5 Mar 27

OX Dovecot Pro ManageSieve service crashes when processing AUTHENTICATE commands with SASL initial responses using liter
CVE-2026-27858 HIGH
7.5 Mar 27

OX Dovecot Pro managesieve-login process crashes repeatedly due to memory exhaustion triggered by unauthenticated attack
CVE-2026-27857 HIGH
7.5 Mar 27

Remote memory-exhaustion denial of service in OX Dovecot Pro (versions up to and including 2.3.0) lets an unauthenticate
CVE-2026-40018 HIGH
7.4 Aug 28

SQL injection in Open-Xchange OX Dovecot Pro and OX Dovecot CE enables unauthenticated remote attackers, under high-comp
CVE-2026-73208 HIGH
7.4 Aug 28

OAuth2 token validation in OX Dovecot Pro and OX Dovecot CE contains a logic error that permits authentication bypass wh

Same weakness CWE-99 – Improper Control of Resource Identifiers ('Resource Injection')

View all
CVE-2022-3774 CRITICAL POC
9.1
CVE-2024-4294 HIGH POC
8.8
CVE-2023-2980 HIGH POC
8.8
CVE-2021-22879 HIGH POC
8.8
CVE-2020-8177 HIGH POC
7.8
CVE-2019-6545 HIGH POC
7.5
CVE-2017-5159 CRITICAL
9.8
CVE-2022-1287 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed

Share

CVE-2026-33603 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy