OX Dovecot Pro CVE-2026-42395

Exploitation strictly requires that the Dovecot deployment be explicitly configured with at least one trusted proxy host - the vendor states outright that 'deployments that do not configure trusted proxies are not affected.' The attacker must control or have compromised a specific host that appears in the trusted proxy allow-list, giving them the ability to send arbitrary forwarding metadata to Dovecot. The CVSS AV:A (Adjacent) vector confirms the attack originates from a host on the adjacent network segment or directly connected to Dovecot. No Dovecot-level authentication is required from the proxy's perspective (PR:N), but controlling a trusted proxy host is itself a significant prerequisite - typically implying internal network access or lateral movement. The DoS effect is deferred: it manifests on the subsequent user login attempt after the malicious NUL-byte forwarding message is processed, not immediately upon injection.

The CVSS 3.1 score of 4.3 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) accurately reflects a moderate, availability-only impact reachable only from an adjacent network position, not the open internet. The adjacent attack vector (AV:A) is a meaningful constraint: successful exploitation requires the attacker to control or compromise a host explicitly listed in Dovecot's trusted proxy configuration, which the vendor's own advisory acknowledges should be restricted to hosts fully under operator control. EPSS data is absent from the available input and cannot be independently cited. The vulnerability is not listed in CISA KEV, and the CVE description explicitly states no publicly available exploits are known, making opportunistic mass exploitation implausible. The purely availability-scoped impact (C:N, I:N) rules out data exfiltration or integrity compromise, limiting blast radius to login service degradation. Real-world priority is low for most organizations; it rises for mail hosting providers running OX Dovecot in proxy-fronted multi-tier architectures where a compromised internal proxy could deny authentication to large user populations.

An attacker who has compromised a host listed in Dovecot's trusted proxy configuration sends a proxy forwarding message containing a NUL byte embedded in the forwarding header fields. The corrupted state causes the Dovecot login process to crash on the next legitimate user authentication attempt, producing repeated login failures and service degradation until the affected login process is restarted. No public exploit code is known, making opportunistic exploitation unlikely, but an insider threat or attacker with lateral access to the proxy network segment could trigger this condition reliably and repeatedly.