Ox Dovecot Ce

Stack exhaustion via crafted compressed IMAP data in OX Dovecot Pro and OX Dovecot CE allows an authenticated remote attacker to crash the IMAP process, causing denial of service. The flaw (CWE-674, Uncontrolled Recursion) is triggered by sending specially constructed compressed payloads that exceed stack depth limits during decompression processing. No public exploit code exists, and exploitation requires valid IMAP credentials, meaningfully limiting the attacker pool.

OAuth2 token validation in OX Dovecot Pro and OX Dovecot CE contains a logic error that permits authentication bypass when the identity provider omits the scope claim from token responses. Dovecot incorrectly falls back to evaluating the audience claim as a substitute for scope, accepting any token whose audience value coincidentally matches a configured scope name - regardless of what permissions that token actually grants. The flaw also silently masks IDP misconfigurations where scope issuance is entirely absent. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the CVSS score of 7.4 (AV:N/AC:H) reflects that successful exploitation yields full confidentiality and integrity access to email.

IMAP compression in OX Dovecot Pro and OX Dovecot CE allows any authenticated user to exhaust the memory of the imap-login process by negotiating a memory-intensive decompression algorithm across multiple simultaneous connections. The process crashes after only a few such connections, terminating all sessions it manages and causing denial of service for all active IMAP users sharing that process. No public exploits are known and CISA KEV does not list this CVE, but the low prerequisite bar - any valid IMAP credential - makes it a meaningful risk in multi-tenant or hosted email environments.

Authenticated Sieve script manipulation in OX Dovecot Pro and CE allows low-privileged mail users to bypass configured per-user CPU resource limits and accumulate orphaned compiled script files on disk. By repeatedly switching the active Sieve script, an attacker resets the CPU accounting stored in each compiled artifact, circumventing the server-enforced cap indefinitely; separately, deleted or renamed scripts leave compiled files behind, causing unbounded disk growth. Sustained exploitation degrades mail delivery service across shared infrastructure. No public exploits are known, no CISA KEV listing exists, and the vendor-reported CVSS severity is Low (3.1).

Login process denial-of-service in OX Dovecot Pro and OX Dovecot CE allows a host designated as a trusted proxy to crash the Dovecot authentication process by injecting a NUL byte into proxy forwarding headers, disrupting subsequent login attempts for all users. The vulnerability carries a CVSS 4.3 (Medium) score with an adjacent-network vector, confining realistic exposure to deployments that explicitly configure trusted proxy hosts - a non-default setup. No public exploit is identified at time of analysis, and Open-Xchange has issued a security advisory with patch guidance.

Timing side-channel in OX Dovecot Pro and CE exposes the length of configured doveadm passwords and API keys to adjacent-network attackers who can send repeated unauthenticated requests and measure response latency with high precision. The secret value itself is never disclosed - only its length - which marginally reduces brute-force search space. No active exploitation is identified and no public exploit exists; the vendor-assigned CVSS score of 3.1 accurately reflects the constrained attack surface and limited practical impact.

Memory disclosure in OX Dovecot Pro and OX Dovecot CE exposes uninitialized server process memory to authenticated IMAP users who send a malformed URLFETCH command. The IMAP URLAUTH extension's error-handling path fails to sanitize its response buffer, returning raw memory contents to the requesting client that may include session tokens, cached credentials, or message data from co-resident sessions. No active exploitation has been identified and no public exploits are known, though the low attack complexity for authenticated users makes insider threats and compromised accounts realistic vectors.

Denial of service in OX Dovecot Pro and OX Dovecot CE allows unauthenticated remote attackers to exhaust memory and CPU on the imap-login process by sending an IMAP ID command with an excessive number of parameters before completing authentication. When the out-of-memory handler terminates the affected imap-login process, all other IMAP connections multiplexed on that same process are simultaneously dropped, amplifying the impact beyond the single malicious session. No public exploits are known, but the low attack complexity and zero authentication requirement make this a practical DoS vector against any internet-exposed OX Dovecot deployment.

Authentication bypass in OX Dovecot Pro and CE allows any host configured as a trusted proxy to impersonate arbitrary mail users without knowing their passwords, by injecting forged fields into Dovecot's internal authentication pipeline. The flaw is conditional: both a trusted proxy must be configured and the password database must honour a field permitting password-free authentication - deployments without trusted proxies are fully unaffected. No public exploit code exists and the vulnerability has not been added to CISA KEV at time of analysis.

Use-after-free in the OX Dovecot Pro and Dovecot CE mail-editing code lets an authenticated user who can install a Sieve filter with the editheader extension corrupt memory during mail delivery, leaking out-of-bounds buffer contents into the delivered message and potentially crashing or executing code in the delivery process. The flaw is remotely reachable with low-privilege credentials (CVSS 9.1, scope-changed) and combines information disclosure with a denial-of-service and possible RCE. No public exploit is identified at time of analysis and it is not on CISA KEV, so risk is currently theoretical but severe.

OAuth2 multi-scope enforcement bypass in OX Dovecot Pro and CE allows an attacker holding a partial-scope OAuth2 token to authenticate and perform operations beyond their granted permissions via the remote token validation path. The remote validation logic incorrectly accepts a token carrying only one of several required scopes, while the local validation path correctly enforces all configured scope requirements - creating an inconsistency exploitable by any holder of a legitimately issued but insufficiently scoped token. No public exploit identified at time of analysis; CVSS 5.9 Medium with high integrity impact reflects a real but configuration-gated privilege escalation risk.

Authentication bypass in OX Dovecot Pro and OX Dovecot CE (both Open-Xchange GmbH email server products) allows a low-privileged authenticated attacker to circumvent access controls and achieve limited integrity impact over the mail service. The vulnerability is classified under CWE-284 (Improper Access Control) and carries a low CVSS base score of 3.1, reflecting high attack complexity and constrained impact - no confidentiality or availability loss is indicated. No public exploit code is known and this CVE is not listed in the CISA KEV catalog.

IMAP compression in OX Dovecot Pro and CE enables a CRIME/BREACH-class side-channel attack where shared compression state across session responses leaks information about mailbox contents. An adversary who can both send mail to a target user and observe the byte sizes of that user's IMAP traffic can use response-size variations to confirm whether a small message body matches a guessed candidate text. No public exploits are known and the attack has not been confirmed as actively exploited; arbitrary content recovery was not demonstrated, bounding real-world impact to oracle-style guess confirmation against short messages.

CPU exhaustion via infinite loop in OX Dovecot CE's ManageSieve login handler allows unauthenticated remote attackers to deny Sieve script management and potentially degrade the entire mail server. The flaw is triggered at the pre-authentication stage, requiring only network access to the ManageSieve port; repeated connections can saturate all available CPU cores. No public exploit code exists, and the CVSS AC:H metric indicates the attack requires precisely crafted input, limiting opportunistic exploitation.

SQL injection in Open-Xchange OX Dovecot Pro and OX Dovecot CE enables unauthenticated remote attackers, under high-complexity conditions, to read and manipulate backend database contents - yielding high confidentiality and integrity impact with no availability disruption. Both the commercial (Pro) and community (CE) editions of the OX-branded Dovecot mail server are confirmed affected per vendor CPE data and the OX advisory OXDC-ADV-2026-0003. No public exploit code has been identified at time of analysis, and the AC:H vector indicates exploitation is non-trivial and likely requires specific environmental or protocol conditions.

OX Dovecot Pro and OX Dovecot CE are susceptible to a hash-collision denial-of-service attack where an attacker who can deliver mail to a target user can craft message headers engineered to collide in an internal hash table, causing the IMAP THREAD command to consume CPU disproportionate to message size. Any mail client issuing THREAD against the poisoned mailbox triggers sustained CPU exhaustion, degrading or denying IMAP service. This is a distinct issue from CVE-2026-40014 and is not resolved by that fix; no public exploit is identified at time of analysis.

Authenticated availability disruption in OX Dovecot Pro and OX Dovecot CE allows any valid credential holder to crash the imap-hibernate service by opening many concurrent connections and sending malformed IMAP commands, triggering an intermittent out-of-bounds read (CWE-125). The crash terminates the imap-hibernate process, dropping hibernated IMAP sessions for co-hosted users and degrading service availability. No public exploit code is known and the vulnerability is not listed in CISA KEV; however, the low attack complexity means any authenticated user on a shared mail platform could attempt disruption.

CPU exhaustion in OX Dovecot's IMAP THREAD command allows a remote unauthenticated attacker to degrade or deny IMAP service by sending a specially crafted message header to any mailbox user. The vulnerability triggers when a mail client subsequently issues a THREAD command on the affected mailbox, causing disproportionate CPU consumption relative to message size. No public exploit code exists and the CVE has not been added to the CISA KEV catalog, but the low attack complexity and zero-authentication requirement make it operationally significant for any organization running OX Dovecot at scale.

Memory corruption via out-of-bounds write in OX Dovecot Pro and OX Dovecot CE's ManageSieve service allows authenticated network attackers to crash the ManageSieve process, denying all users the ability to remotely manage Sieve email filter scripts. The root cause is improper handling of extreme numeric literals during Sieve script compilation. The vendor notes that remote code execution may theoretically be achievable via the same memory corruption primitive, though no public exploit demonstrates this; no public exploits are known and the vulnerability is not listed in CISA KEV.

Uncontrolled CPU consumption in OX Dovecot Pro and OX Dovecot CE allows authenticated IMAP users to trigger a denial of service by issuing malformed or resource-intensive IMAP LIST commands. Both the commercial (Pro) and community (CE) editions of Open-Xchange's Dovecot distribution are affected across all tracked versions per CPE data. No public exploit code has been identified at time of analysis, and the CVSS score of 4.3 reflects the authenticated-access prerequisite and limited availability impact.

Dsync stream protocol command injection in OX Dovecot Pro and OX Dovecot CE allows an authenticated mail user to store crafted content that is later interpreted as dsync protocol commands when an administrator runs dsync with the stream protocol during a migration or replication. Successful injection enables modification of mailbox state on the destination server, including internal mailbox attributes that a user should not be able to manipulate directly. No public exploits are known and no CISA KEV listing exists; exploitation depends on an administrator-initiated dsync stream operation against a mailbox containing attacker-controlled content.

ManageSieve login process in OX Dovecot CE and Pro crashes on receipt of a small malformed pre-authentication command, enabling unauthenticated denial of service against Sieve script management. The blast radius is mode-dependent: high-security mode (CE community default) limits disruption to the attacker's own connection, whereas high-performance mode (Pro default) terminates all connections sharing the same managesieve-login process, making repeated attacks an effective targeted DoS. No public exploit code exists and no CISA KEV listing is present, but the unauthenticated network vector with low complexity makes this straightforward to trigger.

SMTP smuggling in Open-Xchange's OX Dovecot Pro and Community Edition allows an unauthenticated attacker to inject forged SMTP commands into messages relayed through Dovecot, bypassing its outbound content-sanitization logic. By embedding crafted bare carriage return sequences in a message body - delivered via Sieve redirect or submission relay - the attacker causes a vulnerable downstream mail server to misinterpret message body content as new SMTP envelope commands, enabling injection of spoofed email. This is the same vulnerability class as CVE-2023-51764 (Postfix) and CVE-2023-51766 (Exim); no public exploit code exists and the CVE is not listed in CISA's KEV catalog.

Submission-login process crashes with an epoll() panic in OX Dovecot Pro and CE when the per-IP connection limit (mail_max_userip_connections, default 10) is reached, due to improper file descriptor handling (CWE-403). In high-performance mode - the default for Pro releases - the crash terminates all connections managed by the affected process, not just the triggering one, creating a broader denial-of-service for email submission. A secondary side effect of duplicate message delivery is possible when backend TLS is absent. No public exploits are known and this vulnerability is not listed in CISA KEV.

Memory exhaustion in OX Dovecot Pro and OX Dovecot CE allows any remote sender to deny IMAP service to a targeted user by crafting an email whose headers contain an abnormally large number of addresses or MIME parameters. The malicious message passes delivery intact, but when the recipient's IMAP process parses it, uncontrolled memory allocation causes the process to hit its memory limit and terminate, interrupting that user's IMAP session. No public exploits are known and CISA has not added this to the KEV catalog, but the low attack complexity and lack of authentication requirements make this a realistic nuisance-level threat for any Dovecot deployment.