OX Dovecot CVE-2026-40203

IMAP compression must be explicitly enabled in the Dovecot server configuration - deployments with compression disabled are entirely unaffected regardless of version. Beyond this configuration prerequisite, the attacker must satisfy two simultaneous conditions: first, the ability to send mail to the target user's mailbox (to inject attacker-controlled known plaintext into the shared compression stream); second, the ability to observe the byte sizes of the target user's IMAP session traffic (requiring a network-level position such as passive eavesdropping, MitM, or shared-path observation). The CVSS AC:H metric reflects this dual-condition requirement. Exploitation is further bounded by the inability to recover arbitrary content - the oracle only confirms whether a small candidate body matches an actual message, limiting meaningful targets to short, secret-like content such as one-time codes or brief sensitive notifications.

CVSS 3.7 (Low) accurately reflects the practical threat ceiling. AC:H captures the dual attacker requirement - the ability to send mail to the target and the ability to observe compressed IMAP traffic sizes simultaneously - a materially higher bar than a single-condition network exploit. EPSS data was not provided in the input, so exploitation probability cannot be quantified from that signal. The vulnerability is not listed in CISA KEV and no public exploit code has been identified, consistent with the high complexity and constrained impact. The attack cannot recover arbitrary mailbox content; it is limited to confirming guesses about small, secret-like message bodies, which further suppresses practical risk. Deployments where IMAP compression is disabled are entirely unaffected, and IMAP compression is not universally enabled by default, limiting the exposed population. This vulnerability warrants a configuration remediation action but does not justify emergency response prioritization for most organizations.

A malicious actor who can send email to a target user - and who simultaneously occupies a network vantage point such as a compromised upstream router, a shared hosting environment, or a passive ISP-level tap - sends a crafted small message to the target's mailbox and monitors the byte lengths of the user's compressed IMAP session responses. By iterating over candidate message bodies and correlating compression-size deltas, the attacker confirms which candidate matches the actual short message content. No public exploit code exists, and the attack requires careful timing coordination between mail delivery and traffic observation.