CVE-2026-42392
published 2026-08-28CVE-2026-42392: An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response…
PriorityP424medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.27%
18.2th percentile
An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH functionality. Update to non-vulnerable version. No publicly available exploits are known.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dovecot | dovecot | — | — |
| open-xchange_gmbh | ox_dovecot_ce | >= 2.3.0 < 2.4.5 | 2.4.5 |
| open-xchange_gmbh | ox_dovecot_pro | >= 2.3.0 < 3.1.6 | 3.1.6 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client.
ghsa_unreviewed·2026-08-28
CVE-2026-42392 [MEDIUM] CWE-200 An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client.
An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH functionality. Update to non-vulnerable version. No publicly available exploits are known.
Red Hat
dovecot: Dovecot: Information disclosure via invalid IMAP URLFETCH command
vendor_redhat·2026-08-28·CVSS 4.3
CVE-2026-42392 [MEDIUM] CWE-908 dovecot: Dovecot: Information disclosure via invalid IMAP URLFETCH command
dovecot: Dovecot: Information disclosure via invalid IMAP URLFETCH command
An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH functionality. Update to non-vulnerable version. No publicly available exploits are known.
A flaw was found in Dovecot. An attacker with valid credentials can send an invalid IMAP URLFETCH command, leading to the inclusion of uninitialized memory in the error response. This can disclose process memory contents to the client, potentially revealing sensitive data.
Mitigation: To mitigate this issue, disable the IMAP URLAUTH func
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-42392 dovecot: Dovecot: Information disclosure via invalid IMAP URLFETCH command [fedora-all]
bugzilla·2026-09-01·CVSS 4.3
CVE-2026-42392 [MEDIUM] CVE-2026-42392 dovecot: Dovecot: Information disclosure via invalid IMAP URLFETCH command [fedora-all]
CVE-2026-42392 dovecot: Dovecot: Information disclosure via invalid IMAP URLFETCH command [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH functionality. Update to non-vulnerable version. No publicly available exploits are known.
Bugzilla
CVE-2026-42392 dovecot: Dovecot: Information disclosure via invalid IMAP URLFETCH command
bugzilla·2026-08-28·CVSS 4.3
CVE-2026-42392 [MEDIUM] CVE-2026-42392 dovecot: Dovecot: Information disclosure via invalid IMAP URLFETCH command
CVE-2026-42392 dovecot: Dovecot: Information disclosure via invalid IMAP URLFETCH command
An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH functionality. Update to non-vulnerable version. No publicly available exploits are known.
2026-08-28
Published