OX Dovecot CVE-2026-42393

Exploitation requires the attacker to be on the same adjacent network segment as the doveadm service (AV:A per CVSS) - internet-based remote exploitation is not possible. The doveadm service must be reachable on the network (not firewalled to trusted hosts). High attack complexity (AC:H per CVSS) reflects the need to make repeated requests and measure sub-millisecond response timing variations with sufficient statistical confidence to distinguish length-dependent differences from network jitter. No authentication is required to probe the service. Exploitation is significantly limited by the adjacent-network requirement, the measurement precision demanded, and the fact that only secret length - not the secret value - is obtained; a high-entropy secret of any length provides substantial residual protection.

The CVSS vector AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N accurately reflects the realistic threat model. Adjacent-network positioning (AV:A) means the attacker cannot exploit this from the open internet - they must be on the same network segment as the doveadm service. High attack complexity (AC:H) reflects the requirement for precise, repeatable timing measurements under realistic network jitter conditions. The confidentiality impact is inherently limited: only secret length is inferred, not the secret itself; a sufficiently long, high-entropy secret loses little effective security from length disclosure alone. No KEV listing and no public exploit further reduce urgency. EPSS data is not provided in the available intelligence. This is a genuine but low-priority finding - most organizations running doveadm on isolated management networks face near-zero practical risk.

An attacker on the same network segment as the doveadm service sends large numbers of unauthenticated authentication requests while precisely measuring response latency for each attempt. By correlating timing variation with candidate secret lengths, the attacker statistically infers how many characters the configured password or API key contains, then uses that information to constrain a subsequent brute-force or dictionary attack to matching-length candidates. No public exploit code exists for this technique against doveadm.