EUVD-2026-67677
GHSA-gvmq-26g6-c3qh
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Adjacent vector because attack originates from a configured trusted proxy host on the local network; PR:N since no Dovecot authentication is required from the proxy; A:L only, as no confidentiality or integrity impact applies.
Primary rating from Vendor (OX).
CVSS VectorVendor: OX
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.
AnalysisAI
Login process denial-of-service in OX Dovecot Pro and OX Dovecot CE allows a host designated as a trusted proxy to crash the Dovecot authentication process by injecting a NUL byte into proxy forwarding headers, disrupting subsequent login attempts for all users. The vulnerability carries a CVSS 4.3 (Medium) score with an adjacent-network vector, confining realistic exposure to deployments that explicitly configure trusted proxy hosts - a non-default setup. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation strictly requires that the Dovecot deployment be explicitly configured with at least one trusted proxy host - the vendor states outright that 'deployments that do not configure trusted proxies are not affected.' The attacker must control or have compromised a specific host that appears in the trusted proxy allow-list, giving them the ability to send arbitrary forwarding metadata to Dovecot. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 4.3 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) accurately reflects a moderate, availability-only impact reachable only from an adjacent network position, not the open internet. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the non-vulnerable version of OX Dovecot Pro or OX Dovecot CE as directed by the Open-Xchange security advisory at https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json - an exact patched version number is not confirmed in the available input data and must be obtained from the CSAF document directly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ox Dovecot Pro
View allAuthentication-layer injection in OX Dovecot Pro (versions up to and including 2.4.3 and 3.1.4) arises from a flaw in th
Use-after-free in the OX Dovecot Pro and Dovecot CE mail-editing code lets an authenticated user who can install a Sieve
Authentication bypass and user enumeration in OX Dovecot Pro (versions up to and including 3.1.0 and the 2.4.x line up t
OX Dovecot Pro ManageSieve service crashes when processing AUTHENTICATE commands with SASL initial responses using liter
OX Dovecot Pro managesieve-login process crashes repeatedly due to memory exhaustion triggered by unauthenticated attack
Remote memory-exhaustion denial of service in OX Dovecot Pro (versions up to and including 2.3.0) lets an unauthenticate
Denial of service in OX Dovecot Pro and OX Dovecot CE allows unauthenticated remote attackers to exhaust memory and CPU
ManageSieve login process in OX Dovecot CE and Pro crashes on receipt of a small malformed pre-authentication command, e
Memory exhaustion in OX Dovecot Pro and OX Dovecot CE allows any remote sender to deny IMAP service to a targeted user b
OAuth2 token validation in OX Dovecot Pro and OX Dovecot CE contains a logic error that permits authentication bypass wh
SQL injection in Open-Xchange OX Dovecot Pro and OX Dovecot CE enables unauthenticated remote attackers, under high-comp
Stack exhaustion via crafted compressed IMAP data in OX Dovecot Pro and OX Dovecot CE allows an authenticated remote att
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today