Open-Xchange Gmbh Ox Dovecot Ce vulnerabilities

CVE-2026-40203 [LOW] CWE-200 CVE-2026-40203: When IMAP compression is enabled, the same compression state is reused across responses in a session When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail and other mail in the same mailbox. An attacker that can send mail to a user and can also observe the sizes of that user's IMAP traffic can confirm whether the body of a small message matches a gu

CVE-2026-42393 [LOW] CWE-200 CVE-2026-42393: The comparison used for the doveadm password and API key is not fully timing safe and can reveal the The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of the secret, which reduces the effort needed to guess it.

CVE-2026-52681 [LOW] CWE-1050 CVE-2026-52681: Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credential Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script. Compiled script files are also not removed when a script is deleted or renamed. The configured Sieve CPU limit can be bypassed, allowing sustained CPU consumption, and the leftover fil

CVE-2026-40204 [LOW] CWE-284 CVE-2026-40204: None None None No publicly available exploits are known. None None None No publicly available exploits are known.