CVE-2026-42393
published 2026-08-28CVE-2026-42393: The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access…
PriorityP414low3.1CVSS 3.1
AVAACHPRNUINSUCLINAN
EPSS
0.17%
6.5th percentile
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of the secret, which reduces the effort needed to guess it. The secret value itself is not disclosed. Restrict network access to the doveadm service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dovecot | dovecot | — | — |
| open-xchange_gmbh | ox_dovecot_ce | >= 2.3.0 < 2.4.5 | 2.4.5 |
| open-xchange_gmbh | ox_dovecot_pro | >= 2.3.0 < 2.3.22.2 | 2.3.22.2 |
| open-xchange_gmbh | ox_dovecot_pro | >= 3.0.0 < 3.0.7 | 3.0.7 |
| open-xchange_gmbh | ox_dovecot_pro | >= 3.1.0 < 3.1.6 | 3.1.6 |
CVSS provenance
nvdv3.13.1LOWCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
vendor_redhat3.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
dovecot: Dovecot: Information disclosure via timing attack on `doveadm` password/API key comparison
vendor_redhat·2026-08-28·CVSS 3.1
CVE-2026-42393 [LOW] CWE-208 dovecot: Dovecot: Information disclosure via timing attack on `doveadm` password/API key comparison
dovecot: Dovecot: Information disclosure via timing attack on `doveadm` password/API key comparison
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of the secret, which reduces the effort needed to guess it. The secret value itself is not disclosed. Restrict network access to the doveadm service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.
A flaw was found in dovecot. The comparison mechanism for `doveadm` passwords and API keys is not fully timing safe. A remote attacker, with network access to
GHSA
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret.
ghsa_unreviewed·2026-08-28
CVE-2026-42393 [LOW] CWE-200 The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret.
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of the secret, which reduces the effort needed to guess it. The secret value itself is not disclosed. Restrict network access to the doveadm service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-42393 dovecot: Dovecot: Information disclosure via timing attack on `doveadm` password/API key comparison [fedora-all]
bugzilla·2026-09-01·CVSS 3.1
CVE-2026-42393 [LOW] CVE-2026-42393 dovecot: Dovecot: Information disclosure via timing attack on `doveadm` password/API key comparison [fedora-all]
CVE-2026-42393 dovecot: Dovecot: Information disclosure via timing attack on `doveadm` password/API key comparison [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of the secret, which reduces the effort needed to guess it. The secret value itself is not disclosed. Restrict network access to the doveadm service to
Bugzilla
CVE-2026-42393 dovecot: Dovecot: Information disclosure via timing attack on `doveadm` password/API key comparison
bugzilla·2026-08-28·CVSS 3.1
CVE-2026-42393 [LOW] CVE-2026-42393 dovecot: Dovecot: Information disclosure via timing attack on `doveadm` password/API key comparison
CVE-2026-42393 dovecot: Dovecot: Information disclosure via timing attack on `doveadm` password/API key comparison
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of the secret, which reduces the effort needed to guess it. The secret value itself is not disclosed. Restrict network access to the doveadm service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.
2026-08-28
Published