OX Dovecot EUVD-2026-67658

Exploitation requires that mail_max_userip_connections is set and enforced - the default value of 10 means this condition is active in standard out-of-the-box deployments, requiring no special configuration by the administrator. The CVSS vector PR:L confirms the attacker must be authenticated (valid submission credentials required); unauthenticated exploitation is not possible since the connection limit is user/IP-scoped and the crash only occurs at AUTH stage. The amplified impact (all process connections terminated) is limited to high-performance mode, which is the default for OX Dovecot Pro but not for CE/community builds running high-security mode. Duplicate message delivery as a secondary effect is further constrained to deployments where TLS is not used on the backend mail processing server. Exploitation is bounded to a single submission-login process and does not affect IMAP/POP3 services or the broader server.

The vendor-assigned CVSS 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L accurately reflects the limited but genuine availability impact: an authenticated attacker can trigger a targeted DoS against email submission with low complexity. EPSS data is not provided, but the absence of a KEV listing and no publicly available exploits substantially lowers the urgency of emergency response. The real-world risk is highest for OX Dovecot Pro deployments running in default high-performance mode, where a single triggered crash disrupts all users sharing the affected submission-login process rather than only the attacker's session. Duplicate message delivery is a conditional integrity side-effect requiring the absence of backend TLS, but the vendor scored I:N, treating it as out of scope for the base CVSS. The practical threat is an authenticated user (or a compromised account) deliberately saturating their per-IP connection slot to deny email submission capability - not a high-sophistication attack, but limited in scope to authenticated principals. No conflicting signals are present; CVSS, description, and exploitation conditions are internally consistent.

An authenticated email user or attacker holding valid credentials opens ten or more concurrent SMTP submission connections from a single IP address, exhausting the mail_max_userip_connections limit and triggering the epoll() file descriptor panic in the submission-login process. On an OX Dovecot Pro server running in default high-performance mode, this crashes the shared process and disconnects all other users whose sessions were being handled by that process, causing a denial of email submission service. No public exploit code exists for this scenario.