OX Dovecot CVE-2026-33604

Exploitation requires that the attacker can induce OX Dovecot to relay a crafted message outbound - specifically via a Sieve redirect rule (user-configured mail forwarding) or a submission relay path. The attacker requires no authentication to Dovecot itself (PR:N per CVSS vector), but must be able to deliver a message that Dovecot will subsequently relay. A second condition is mandatory: a vulnerable downstream SMTP server that accepts bare carriage returns as line terminators must be present in the relay path; the spoofing impact occurs on that downstream server, not within Dovecot. Exploitation is therefore bounded to deployments where both conditions simultaneously hold: an active relay path through OX Dovecot and an unpatched receiving MTA. Environments where all downstream servers have addressed SMTP smuggling (e.g., by rejecting bare CRs) are not exploitable even with unpatched Dovecot.

The CVSS 3.1 score of 5.9 Medium (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) accurately reflects the high attack complexity created by the dual-dependency structure: exploitation requires both a functional Dovecot relay path (Sieve redirect or submission relay accepting attacker-influenced messages) and a downstream SMTP server that has not yet addressed the base SMTP smuggling vulnerability class. No EPSS data was provided; with no KEV listing and no confirmed public exploit code, mass opportunistic exploitation is unlikely in the near term. The S:U (scope unchanged) designation in the provided vector arguably understates the real-world impact, because the tangible harm - forged email acceptance - occurs on a downstream server outside the Dovecot boundary; this analysis independently assesses scope as Changed, which would push the effective severity above 5.9. Organizations operating OX Dovecot as a relay hub in heterogeneous mail environments with legacy or unpatched downstream MTAs face the most concrete risk. The integrity-only impact profile (no confidentiality, no availability) is nonetheless operationally significant: successful spoofing enables phishing, business email compromise, and audit/compliance violations.

An attacker delivers a crafted message to a mailbox on the OX Dovecot server where a Sieve redirect rule or submission relay path causes Dovecot to forward the message to a downstream SMTP server that has not patched its SMTP smuggling vulnerability. The crafted message body embeds a bare carriage return sequence positioned to appear as a valid SMTP command terminator to the downstream server, causing it to interpret subsequent body content as a new SMTP envelope and accept delivery of a spoofed message as if from an arbitrary sender. No public proof-of-concept code exists, but the underlying technique is well-documented from the 2023 SMTP smuggling research wave covering CVE-2023-51764 and CVE-2023-51766.