Open Xchange Gmbh

CVE	Summary	Severity	CVSS	EPSS	Priority
CVE-2026-42007	Use-after-free in the OX Dovecot Pro and Dovecot CE mail-editing code lets an authenticated user who can install a Sieve filter with the editheader extension corrupt memory during mail delivery, leaking out-of-bounds buffer contents into the delivered message and potentially crashing or executing code in the delivery process. The flaw is remotely reachable with low-privilege credentials (CVSS 9.1, scope-changed) and combines information disclosure with a denial-of-service and possible RCE. No public exploit is identified at time of analysis and it is not on CISA KEV, so risk is currently theoretical but severe.	CRITICAL	9.1	0.3%	46
CVE-2026-33605	ManageSieve login process in OX Dovecot CE and Pro crashes on receipt of a small malformed pre-authentication command, enabling unauthenticated denial of service against Sieve script management. The blast radius is mode-dependent: high-security mode (CE community default) limits disruption to the attacker's own connection, whereas high-performance mode (Pro default) terminates all connections sharing the same managesieve-login process, making repeated attacks an effective targeted DoS. No public exploit code exists and no CISA KEV listing is present, but the unauthenticated network vector with low complexity makes this straightforward to trigger.	HIGH	7.5	0.4%	38
CVE-2026-42391	Denial of service in OX Dovecot Pro and OX Dovecot CE allows unauthenticated remote attackers to exhaust memory and CPU on the imap-login process by sending an IMAP ID command with an excessive number of parameters before completing authentication. When the out-of-memory handler terminates the affected imap-login process, all other IMAP connections multiplexed on that same process are simultaneously dropped, amplifying the impact beyond the single malicious session. No public exploits are known, but the low attack complexity and zero authentication requirement make this a practical DoS vector against any internet-exposed OX Dovecot deployment.	HIGH	7.5	0.4%	38
CVE-2026-27852	Memory exhaustion in OX Dovecot Pro and OX Dovecot CE allows any remote sender to deny IMAP service to a targeted user by crafting an email whose headers contain an abnormally large number of addresses or MIME parameters. The malicious message passes delivery intact, but when the recipient's IMAP process parses it, uncontrolled memory allocation causes the process to hit its memory limit and terminate, interrupting that user's IMAP session. No public exploits are known and CISA has not added this to the KEV catalog, but the low attack complexity and lack of authentication requirements make this a realistic nuisance-level threat for any Dovecot deployment.	HIGH	7.5	0.4%	38
CVE-2026-40018	SQL injection in Open-Xchange OX Dovecot Pro and OX Dovecot CE enables unauthenticated remote attackers, under high-complexity conditions, to read and manipulate backend database contents - yielding high confidentiality and integrity impact with no availability disruption. Both the commercial (Pro) and community (CE) editions of the OX-branded Dovecot mail server are confirmed affected per vendor CPE data and the OX advisory OXDC-ADV-2026-0003. No public exploit code has been identified at time of analysis, and the AC:H vector indicates exploitation is non-trivial and likely requires specific environmental or protocol conditions.	HIGH	7.4	0.3%	37
CVE-2026-73208	OAuth2 token validation in OX Dovecot Pro and OX Dovecot CE contains a logic error that permits authentication bypass when the identity provider omits the scope claim from token responses. Dovecot incorrectly falls back to evaluating the audience claim as a substitute for scope, accepting any token whose audience value coincidentally matches a configured scope name - regardless of what permissions that token actually grants. The flaw also silently masks IDP misconfigurations where scope issuance is entirely absent. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the CVSS score of 7.4 (AV:N/AC:H) reflects that successful exploitation yields full confidentiality and integrity access to email.	HIGH	7.4	0.3%	37
CVE-2026-52687	IMAP compression in OX Dovecot Pro and OX Dovecot CE allows any authenticated user to exhaust the memory of the imap-login process by negotiating a memory-intensive decompression algorithm across multiple simultaneous connections. The process crashes after only a few such connections, terminating all sessions it manages and causing denial of service for all active IMAP users sharing that process. No public exploits are known and CISA KEV does not list this CVE, but the low prerequisite bar - any valid IMAP credential - makes it a meaningful risk in multi-tenant or hosted email environments.	MEDIUM	6.5	0.3%	33
CVE-2026-73209	Stack exhaustion via crafted compressed IMAP data in OX Dovecot Pro and OX Dovecot CE allows an authenticated remote attacker to crash the IMAP process, causing denial of service. The flaw (CWE-674, Uncontrolled Recursion) is triggered by sending specially constructed compressed payloads that exceed stack depth limits during decompression processing. No public exploit code exists, and exploitation requires valid IMAP credentials, meaningfully limiting the attacker pool.	MEDIUM	6.5	0.3%	33
CVE-2026-40014	CPU exhaustion in OX Dovecot's IMAP THREAD command allows a remote unauthenticated attacker to degrade or deny IMAP service by sending a specially crafted message header to any mailbox user. The vulnerability triggers when a mail client subsequently issues a THREAD command on the affected mailbox, causing disproportionate CPU consumption relative to message size. No public exploit code exists and the CVE has not been added to the CISA KEV catalog, but the low attack complexity and zero-authentication requirement make it operationally significant for any organization running OX Dovecot at scale.	MEDIUM	6.5	0.3%	33
CVE-2026-40017	OX Dovecot Pro and OX Dovecot CE are susceptible to a hash-collision denial-of-service attack where an attacker who can deliver mail to a target user can craft message headers engineered to collide in an internal hash table, causing the IMAP THREAD command to consume CPU disproportionate to message size. Any mail client issuing THREAD against the poisoned mailbox triggers sustained CPU exhaustion, degrading or denying IMAP service. This is a distinct issue from CVE-2026-40014 and is not resolved by that fix; no public exploit is identified at time of analysis.	MEDIUM	6.5	0.3%	33
CVE-2026-40019	CPU exhaustion via infinite loop in OX Dovecot CE's ManageSieve login handler allows unauthenticated remote attackers to deny Sieve script management and potentially degrade the entire mail server. The flaw is triggered at the pre-authentication stage, requiring only network access to the ManageSieve port; repeated connections can saturate all available CPU cores. No public exploit code exists, and the CVSS AC:H metric indicates the attack requires precisely crafted input, limiting opportunistic exploitation.	MEDIUM	5.9	0.3%	30
CVE-2026-33604	SMTP smuggling in Open-Xchange's OX Dovecot Pro and Community Edition allows an unauthenticated attacker to inject forged SMTP commands into messages relayed through Dovecot, bypassing its outbound content-sanitization logic. By embedding crafted bare carriage return sequences in a message body - delivered via Sieve redirect or submission relay - the attacker causes a vulnerable downstream mail server to misinterpret message body content as new SMTP envelope commands, enabling injection of spoofed email. This is the same vulnerability class as CVE-2023-51764 (Postfix) and CVE-2023-51766 (Exim); no public exploit code exists and the CVE is not listed in CISA's KEV catalog.	MEDIUM	5.9	0.3%	30
CVE-2026-40205	OAuth2 multi-scope enforcement bypass in OX Dovecot Pro and CE allows an attacker holding a partial-scope OAuth2 token to authenticate and perform operations beyond their granted permissions via the remote token validation path. The remote validation logic incorrectly accepts a token carrying only one of several required scopes, while the local validation path correctly enforces all configured scope requirements - creating an inconsistency exploitable by any holder of a legitimately issued but insufficiently scoped token. No public exploit identified at time of analysis; CVSS 5.9 Medium with high integrity impact reflects a real but configuration-gated privilege escalation risk.	MEDIUM	5.9	0.2%	30
CVE-2026-33606	Dsync stream protocol command injection in OX Dovecot Pro and OX Dovecot CE allows an authenticated mail user to store crafted content that is later interpreted as dsync protocol commands when an administrator runs dsync with the stream protocol during a migration or replication. Successful injection enables modification of mailbox state on the destination server, including internal mailbox attributes that a user should not be able to manipulate directly. No public exploits are known and no CISA KEV listing exists; exploitation depends on an administrator-initiated dsync stream operation against a mailbox containing attacker-controlled content.	MEDIUM	4.8	0.2%	24
CVE-2026-40013	Memory corruption via out-of-bounds write in OX Dovecot Pro and OX Dovecot CE's ManageSieve service allows authenticated network attackers to crash the ManageSieve process, denying all users the ability to remotely manage Sieve email filter scripts. The root cause is improper handling of extreme numeric literals during Sieve script compilation. The vendor notes that remote code execution may theoretically be achievable via the same memory corruption primitive, though no public exploit demonstrates this; no public exploits are known and the vulnerability is not listed in CISA KEV.	MEDIUM	4.3	0.5%	22

CVE-2026-42007

Use-after-free in the OX Dovecot Pro and Dovecot CE mail-editing code lets an authenticated user who can install a Sieve filter with the editheader extension corrupt memory during mail delivery, leaking out-of-bounds buffer contents into the delivered message and potentially crashing or executing code in the delivery process. The flaw is remotely reachable with low-privilege credentials (CVSS 9.1, scope-changed) and combines information disclosure with a denial-of-service and possible RCE. No public exploit is identified at time of analysis and it is not on CISA KEV, so risk is currently theoretical but severe.

CRITICAL

9.1

0.3%

46

CVE-2026-33605

ManageSieve login process in OX Dovecot CE and Pro crashes on receipt of a small malformed pre-authentication command, enabling unauthenticated denial of service against Sieve script management. The blast radius is mode-dependent: high-security mode (CE community default) limits disruption to the attacker's own connection, whereas high-performance mode (Pro default) terminates all connections sharing the same managesieve-login process, making repeated attacks an effective targeted DoS. No public exploit code exists and no CISA KEV listing is present, but the unauthenticated network vector with low complexity makes this straightforward to trigger.

HIGH

7.5

0.4%

38

CVE-2026-42391

Denial of service in OX Dovecot Pro and OX Dovecot CE allows unauthenticated remote attackers to exhaust memory and CPU on the imap-login process by sending an IMAP ID command with an excessive number of parameters before completing authentication. When the out-of-memory handler terminates the affected imap-login process, all other IMAP connections multiplexed on that same process are simultaneously dropped, amplifying the impact beyond the single malicious session. No public exploits are known, but the low attack complexity and zero authentication requirement make this a practical DoS vector against any internet-exposed OX Dovecot deployment.

HIGH

7.5

0.4%

38

CVE-2026-27852

Memory exhaustion in OX Dovecot Pro and OX Dovecot CE allows any remote sender to deny IMAP service to a targeted user by crafting an email whose headers contain an abnormally large number of addresses or MIME parameters. The malicious message passes delivery intact, but when the recipient's IMAP process parses it, uncontrolled memory allocation causes the process to hit its memory limit and terminate, interrupting that user's IMAP session. No public exploits are known and CISA has not added this to the KEV catalog, but the low attack complexity and lack of authentication requirements make this a realistic nuisance-level threat for any Dovecot deployment.

HIGH

7.5

0.4%

38

CVE-2026-40018

SQL injection in Open-Xchange OX Dovecot Pro and OX Dovecot CE enables unauthenticated remote attackers, under high-complexity conditions, to read and manipulate backend database contents - yielding high confidentiality and integrity impact with no availability disruption. Both the commercial (Pro) and community (CE) editions of the OX-branded Dovecot mail server are confirmed affected per vendor CPE data and the OX advisory OXDC-ADV-2026-0003. No public exploit code has been identified at time of analysis, and the AC:H vector indicates exploitation is non-trivial and likely requires specific environmental or protocol conditions.

HIGH

7.4

0.3%

37

CVE-2026-73208

OAuth2 token validation in OX Dovecot Pro and OX Dovecot CE contains a logic error that permits authentication bypass when the identity provider omits the scope claim from token responses. Dovecot incorrectly falls back to evaluating the audience claim as a substitute for scope, accepting any token whose audience value coincidentally matches a configured scope name - regardless of what permissions that token actually grants. The flaw also silently masks IDP misconfigurations where scope issuance is entirely absent. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the CVSS score of 7.4 (AV:N/AC:H) reflects that successful exploitation yields full confidentiality and integrity access to email.

HIGH

7.4

0.3%

37

CVE-2026-52687

IMAP compression in OX Dovecot Pro and OX Dovecot CE allows any authenticated user to exhaust the memory of the imap-login process by negotiating a memory-intensive decompression algorithm across multiple simultaneous connections. The process crashes after only a few such connections, terminating all sessions it manages and causing denial of service for all active IMAP users sharing that process. No public exploits are known and CISA KEV does not list this CVE, but the low prerequisite bar - any valid IMAP credential - makes it a meaningful risk in multi-tenant or hosted email environments.

MEDIUM

6.5

0.3%

33

CVE-2026-73209

Stack exhaustion via crafted compressed IMAP data in OX Dovecot Pro and OX Dovecot CE allows an authenticated remote attacker to crash the IMAP process, causing denial of service. The flaw (CWE-674, Uncontrolled Recursion) is triggered by sending specially constructed compressed payloads that exceed stack depth limits during decompression processing. No public exploit code exists, and exploitation requires valid IMAP credentials, meaningfully limiting the attacker pool.

MEDIUM

6.5

0.3%

33

CVE-2026-40014

CPU exhaustion in OX Dovecot's IMAP THREAD command allows a remote unauthenticated attacker to degrade or deny IMAP service by sending a specially crafted message header to any mailbox user. The vulnerability triggers when a mail client subsequently issues a THREAD command on the affected mailbox, causing disproportionate CPU consumption relative to message size. No public exploit code exists and the CVE has not been added to the CISA KEV catalog, but the low attack complexity and zero-authentication requirement make it operationally significant for any organization running OX Dovecot at scale.

MEDIUM

6.5

0.3%

33

CVE-2026-40017

OX Dovecot Pro and OX Dovecot CE are susceptible to a hash-collision denial-of-service attack where an attacker who can deliver mail to a target user can craft message headers engineered to collide in an internal hash table, causing the IMAP THREAD command to consume CPU disproportionate to message size. Any mail client issuing THREAD against the poisoned mailbox triggers sustained CPU exhaustion, degrading or denying IMAP service. This is a distinct issue from CVE-2026-40014 and is not resolved by that fix; no public exploit is identified at time of analysis.

MEDIUM

6.5

0.3%

33

CVE-2026-40019

CPU exhaustion via infinite loop in OX Dovecot CE's ManageSieve login handler allows unauthenticated remote attackers to deny Sieve script management and potentially degrade the entire mail server. The flaw is triggered at the pre-authentication stage, requiring only network access to the ManageSieve port; repeated connections can saturate all available CPU cores. No public exploit code exists, and the CVSS AC:H metric indicates the attack requires precisely crafted input, limiting opportunistic exploitation.

MEDIUM

5.9

0.3%

30

CVE-2026-33604

SMTP smuggling in Open-Xchange's OX Dovecot Pro and Community Edition allows an unauthenticated attacker to inject forged SMTP commands into messages relayed through Dovecot, bypassing its outbound content-sanitization logic. By embedding crafted bare carriage return sequences in a message body - delivered via Sieve redirect or submission relay - the attacker causes a vulnerable downstream mail server to misinterpret message body content as new SMTP envelope commands, enabling injection of spoofed email. This is the same vulnerability class as CVE-2023-51764 (Postfix) and CVE-2023-51766 (Exim); no public exploit code exists and the CVE is not listed in CISA's KEV catalog.

MEDIUM

5.9

0.3%

30

CVE-2026-40205

OAuth2 multi-scope enforcement bypass in OX Dovecot Pro and CE allows an attacker holding a partial-scope OAuth2 token to authenticate and perform operations beyond their granted permissions via the remote token validation path. The remote validation logic incorrectly accepts a token carrying only one of several required scopes, while the local validation path correctly enforces all configured scope requirements - creating an inconsistency exploitable by any holder of a legitimately issued but insufficiently scoped token. No public exploit identified at time of analysis; CVSS 5.9 Medium with high integrity impact reflects a real but configuration-gated privilege escalation risk.

MEDIUM

5.9

0.2%

30

CVE-2026-33606

Dsync stream protocol command injection in OX Dovecot Pro and OX Dovecot CE allows an authenticated mail user to store crafted content that is later interpreted as dsync protocol commands when an administrator runs dsync with the stream protocol during a migration or replication. Successful injection enables modification of mailbox state on the destination server, including internal mailbox attributes that a user should not be able to manipulate directly. No public exploits are known and no CISA KEV listing exists; exploitation depends on an administrator-initiated dsync stream operation against a mailbox containing attacker-controlled content.

MEDIUM

4.8

0.2%

24

CVE-2026-40013

Memory corruption via out-of-bounds write in OX Dovecot Pro and OX Dovecot CE's ManageSieve service allows authenticated network attackers to crash the ManageSieve process, denying all users the ability to remotely manage Sieve email filter scripts. The root cause is improper handling of extreme numeric literals during Sieve script compilation. The vendor notes that remote code execution may theoretically be achievable via the same memory corruption primitive, though no public exploit demonstrates this; no public exploits are known and the vulnerability is not listed in CISA KEV.

MEDIUM

4.3

0.5%

22

Severity Breakdown

Monthly CVE Trend

Affected Products (3)

Top Risky CVEs