Open-Xchange Gmbh Ox Dovecot Ce vulnerabilities

CVE-2026-42007 [CRITICAL] CWE-416 CVE-2026-42007: An attacker that has valid credentials can use a Sieve script with the editheader extension to trigg An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during mail delivery, which can crash the delivery process

CVE-2026-73208 [HIGH] CWE-287 CVE-2026-73208: An attacker that holds a token intended for a different purpose can authenticate, because when an OA An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim does not describe what a token is allowed to do. A token

CVE-2026-33605 [HIGH] CWE-400 CVE-2026-33605: An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed com An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode (default for community releases), only the attacker's own connection is terminated. If running in high-performance mode (default for Pro releases), all connections handled by the same managesi

CVE-2026-42391 [HIGH] CWE-400 CVE-2026-42391: An unauthenticated attacker can send an IMAP ID command with a very large number of parameters befor An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by the same process. This can cause degradation or denial

CVE-2026-40018 [HIGH] CWE-89 CVE-2026-40018: None None None No publicly available exploits are known. None None None No publicly available exploits are known.

CVE-2026-27852 [HIGH] CWE-400 CVE-2026-27852: An attacker that can send mail to a user can craft a message whose headers contain a very large numb An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, causing denial of serv

CVE-2026-52687 [MEDIUM] CWE-400 CVE-2026-52687: An attacker that has valid credentials can select a compression algorithm for the IMAP connection wh An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections. The memory limit of the process is reached with only a few connections, terminating the process and all connections it handles, which can cause degradation o

CVE-2026-73209 [MEDIUM] CWE-674 CVE-2026-73209: An attacker that has valid credentials can send crafted compressed data that causes the affected pro An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits are known.

CVE-2026-40205 [MEDIUM] CWE-287 CVE-2026-40205: An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, b An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, while the local token validation path correctly requires all of them. The configured authorization policy

CVE-2026-40019 [MEDIUM] CWE-400 CVE-2026-40019: An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, w An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can cause degradation or denial of service for Sieve script management, and repeated connections can consume all available CPU on the server. Monitor system for abnormal CPU usage and kill the

CVE-2026-40014 [MEDIUM] CWE-400 CVE-2026-40014: An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD comma An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage, kill the offending process

CVE-2023-51764 [MEDIUM] CWE-345 CVE-2023-51764: Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_un Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass

CVE-2026-40013 [MEDIUM] CWE-124 CVE-2026-40013: An attacker that has valid credentials can submit a Sieve script containing an extreme numeric liter An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script. This causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of service for script management. This might be able to be us

CVE-2026-33606 [MEDIUM] CWE-93 CVE-2026-33606: Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands wh Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, including internal mailbox attributes that a user should not b

CVE-2026-40015 [MEDIUM] CWE-125 CVE-2026-40015: An attacker that has valid credentials can open many connections to the imap-hibernate service and s An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermittently cause an out-of-bounds read and crash the process. The crash interrupts hibernated IMAP sessions handled by the affected process, which can cause degradation of service for IMAP. Disable IMAP hibernation.

CVE-2026-42392 [MEDIUM] CWE-200 CVE-2026-42392: An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes unini An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH functionality. Update to non-vulnerable version. No publicl

CVE-2026-33263 [MEDIUM] CWE-403 CVE-2026-33263: When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with ep When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. If running in high-security mode (default for community releases), only the new submission connection gets terminated. If running in high-performance mode (default for Pro releases), all connectio

CVE-2026-33607 [MEDIUM] CWE-400 CVE-2026-33607: An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degr An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. No publicly available exploits are known.

CVE-2026-42008 [MEDIUM] CWE-287 CVE-2026-42008: Forwarding information received from a host listed as a trusted proxy is not kept separate from Dove Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments

CVE-2026-42395 [MEDIUM] CWE-400 CVE-2026-42395: A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashe A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy ne