EUVD-2026-67659
GHSA-ccxf-782r-4742
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Scope Changed because the tangible impact - forged email acceptance - occurs on a downstream server outside Dovecot; remaining metrics align with the provided vector.
Primary rating from Vendor (OX).
CVSS VectorVendor: OX
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that hasn't yet fixed the SMTP smuggling vulnerability can be tricked into treating part of the message body as new SMTP commands, allowing injection of spoofed email. This is the same vulnerability class as CVE-2023-51764 and CVE-2023-51766. Where you control the receiving mail servers, ensure they reject bare carriage returns in message data. Update to non-vulnerable version. No publicly available exploits are known.
AnalysisAI
SMTP smuggling in Open-Xchange's OX Dovecot Pro and Community Edition allows an unauthenticated attacker to inject forged SMTP commands into messages relayed through Dovecot, bypassing its outbound content-sanitization logic. By embedding crafted bare carriage return sequences in a message body - delivered via Sieve redirect or submission relay - the attacker causes a vulnerable downstream mail server to misinterpret message body content as new SMTP envelope commands, enabling injection of spoofed email. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker can induce OX Dovecot to relay a crafted message outbound - specifically via a Sieve redirect rule (user-configured mail forwarding) or a submission relay path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.9 Medium (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) accurately reflects the high attack complexity created by the dual-dependency structure: exploitation requires both a functional Dovecot relay path (Sieve redirect or submission relay accepting attacker-influenced messages) and a downstream SMTP server that has not yet addressed the base SMTP smuggling vulnerability class. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the patched release of OX Dovecot Pro or OX Dovecot CE as specified in the Open-Xchange security advisory at https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json; exact fix version numbers must be confirmed from that source as they are not present in current public data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ox Dovecot Pro
View allAuthentication-layer injection in OX Dovecot Pro (versions up to and including 2.4.3 and 3.1.4) arises from a flaw in th
Use-after-free in the OX Dovecot Pro and Dovecot CE mail-editing code lets an authenticated user who can install a Sieve
Authentication bypass and user enumeration in OX Dovecot Pro (versions up to and including 3.1.0 and the 2.4.x line up t
OX Dovecot Pro ManageSieve service crashes when processing AUTHENTICATE commands with SASL initial responses using liter
OX Dovecot Pro managesieve-login process crashes repeatedly due to memory exhaustion triggered by unauthenticated attack
Remote memory-exhaustion denial of service in OX Dovecot Pro (versions up to and including 2.3.0) lets an unauthenticate
Denial of service in OX Dovecot Pro and OX Dovecot CE allows unauthenticated remote attackers to exhaust memory and CPU
ManageSieve login process in OX Dovecot CE and Pro crashes on receipt of a small malformed pre-authentication command, e
Memory exhaustion in OX Dovecot Pro and OX Dovecot CE allows any remote sender to deny IMAP service to a targeted user b
OAuth2 token validation in OX Dovecot Pro and OX Dovecot CE contains a logic error that permits authentication bypass wh
SQL injection in Open-Xchange OX Dovecot Pro and OX Dovecot CE enables unauthenticated remote attackers, under high-comp
Stack exhaustion via crafted compressed IMAP data in OX Dovecot Pro and OX Dovecot CE allows an authenticated remote att
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today