CVE-2026-42395
published 2026-08-28CVE-2026-42395: A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The…
PriorityP419medium4.3CVSS 3.1
AVAACLPRNUINSUCNINAL
EPSS
0.35%
27.7th percentile
A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dovecot | dovecot | — | — |
| open-xchange_gmbh | ox_dovecot_ce | >= 2.3.0 < 2.4.5 | 2.4.5 |
| open-xchange_gmbh | ox_dovecot_pro | >= 2.3.0 < 2.3.22.2 | 2.3.22.2 |
| open-xchange_gmbh | ox_dovecot_pro | >= 3.0.0 < 3.0.7 | 3.0.7 |
| open-xchange_gmbh | ox_dovecot_pro | >= 3.1.0 < 3.1.6 | 3.1.6 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt.
ghsa_unreviewed·2026-08-28
CVE-2026-42395 [MEDIUM] CWE-400 A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt.
A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.
Red Hat
dovecot: Dovecot: Denial of Service via NUL byte in forwarding information
vendor_redhat·2026-08-28·CVSS 4.3
CVE-2026-42395 [MEDIUM] CWE-170 dovecot: Dovecot: Denial of Service via NUL byte in forwarding information
dovecot: Dovecot: Denial of Service via NUL byte in forwarding information
A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.
A flaw was found in Dovecot. A remote attacker, if able to send forwarding information from a host configured as a trusted proxy, could send a NUL byte that crashes the login process. This termination of the login process can lead to a denial of
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-42395 dovecot: Dovecot: Denial of Service via NUL byte in forwarding information [fedora-all]
bugzilla·2026-09-01·CVSS 4.3
CVE-2026-42395 [MEDIUM] CVE-2026-42395 dovecot: Dovecot: Denial of Service via NUL byte in forwarding information [fedora-all]
CVE-2026-42395 dovecot: Dovecot: Denial of Service via NUL byte in forwarding information [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are
Bugzilla
CVE-2026-42395 dovecot: Dovecot: Denial of Service via NUL byte in forwarding information
bugzilla·2026-08-28·CVSS 4.3
CVE-2026-42395 [MEDIUM] CVE-2026-42395 dovecot: Dovecot: Denial of Service via NUL byte in forwarding information
CVE-2026-42395 dovecot: Dovecot: Denial of Service via NUL byte in forwarding information
A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.
2026-08-28
Published