# Open-Xchange GmbH OX Dovecot Pro.

Every CVE that names Open-Xchange GmbH OX Dovecot Pro among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Uncontrolled recursion in Open-Xchange GmbH OX Dovecot Pro and others](https://agentprime.io/advisories/CVE-2026-73209.md)
  `CVE-2026-73209` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Denial of service
- [Improper authentication in Open-Xchange GmbH OX Dovecot Pro and others](https://agentprime.io/advisories/CVE-2026-73208.md)
  `CVE-2026-73208` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 7.4 High · Not analysed yet · Published 28 Aug 2026 · Tags: Authentication bypass
- [Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro and others](https://agentprime.io/advisories/CVE-2026-52687.md)
  `CVE-2026-52687` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Denial of service
- [Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script.](https://agentprime.io/advisories/CVE-2026-52681.md)
  `CVE-2026-52681` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 3.1 Low · Not analysed yet · Published 28 Aug 2026 · Tags: CWE-1050
- [Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro and others](https://agentprime.io/advisories/CVE-2026-42395.md)
  `CVE-2026-42395` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Denial of service
- [Information disclosure in Open-Xchange GmbH OX Dovecot Pro and others](https://agentprime.io/advisories/CVE-2026-42393.md)
  `CVE-2026-42393` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 3.1 Low · Not analysed yet · Published 28 Aug 2026 · Tags: Information disclosure
- [Information disclosure in Open-Xchange GmbH OX Dovecot Pro and others](https://agentprime.io/advisories/CVE-2026-42392.md)
  `CVE-2026-42392` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Information disclosure
- [Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro and others](https://agentprime.io/advisories/CVE-2026-42391.md)
  `CVE-2026-42391` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 7.5 High · Not analysed yet · Published 28 Aug 2026 · Tags: Denial of service
- [Improper authentication in Open-Xchange GmbH OX Dovecot Pro and others](https://agentprime.io/advisories/CVE-2026-42008.md)
  `CVE-2026-42008` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Authentication bypass
- [Use after free in Open-Xchange GmbH OX Dovecot Pro and others](https://agentprime.io/advisories/CVE-2026-42007.md)
  `CVE-2026-42007` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Aug 2026 · Tags: Memory corruption
- [Improper authentication in Open-Xchange GmbH OX Dovecot Pro and others](https://agentprime.io/advisories/CVE-2026-40205.md)
  `CVE-2026-40205` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 5.9 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Authentication bypass
- [Improper access control in Open-Xchange GmbH OX Dovecot Pro and others](https://agentprime.io/advisories/CVE-2026-40204.md)
  `CVE-2026-40204` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 3.1 Low · Not analysed yet · Published 28 Aug 2026 · Tags: Broken access control
- [Information disclosure in Open-Xchange GmbH OX Dovecot Pro and others](https://agentprime.io/advisories/CVE-2026-40203.md)
  `CVE-2026-40203` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 3.7 Low · Not analysed yet · Published 28 Aug 2026 · Tags: Information disclosure
- [SQL injection in Open-Xchange GmbH OX Dovecot Pro and others](https://agentprime.io/advisories/CVE-2026-40018.md)
  `CVE-2026-40018` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 7.4 High · Not analysed yet · Published 28 Aug 2026 · Tags: SQL injection
- [Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro and others](https://agentprime.io/advisories/CVE-2026-40017.md)
  `CVE-2026-40017` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Denial of service
- [Out-of-bounds read in Open-Xchange GmbH OX Dovecot Pro and others](https://agentprime.io/advisories/CVE-2026-40015.md)
  `CVE-2026-40015` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Memory corruption
- [Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro and others](https://agentprime.io/advisories/CVE-2026-40014.md)
  `CVE-2026-40014` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Denial of service
- [An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script.](https://agentprime.io/advisories/CVE-2026-40013.md)
  `CVE-2026-40013` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Memory corruption
- [Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro and others](https://agentprime.io/advisories/CVE-2026-33607.md)
  `CVE-2026-33607` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Denial of service
- [CRLF injection in Open-Xchange GmbH OX Dovecot Pro and others](https://agentprime.io/advisories/CVE-2026-33606.md)
  `CVE-2026-33606` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 4.8 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Other injection
- [Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro and others](https://agentprime.io/advisories/CVE-2026-33605.md)
  `CVE-2026-33605` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 7.5 High · Not analysed yet · Published 28 Aug 2026 · Tags: Denial of service
- [An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that p…](https://agentprime.io/advisories/CVE-2026-33604.md)
  `CVE-2026-33604` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 5.9 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: CWE-655
- [When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues.](https://agentprime.io/advisories/CVE-2026-33263.md)
  `CVE-2026-33263` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: CWE-403
- [Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro and others](https://agentprime.io/advisories/CVE-2026-27852.md)
  `CVE-2026-27852` · CVE record: Open-Xchange GmbH OX Dovecot Pro and 1 more · CVSS 7.5 High · Not analysed yet · Published 28 Aug 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro](https://agentprime.io/advisories/CVE-2026-42006.md)
  `CVE-2026-42006` · CVE record: Open-Xchange GmbH OX Dovecot Pro · CVSS 4.3 Medium · Not analysed yet · Published 12 May 2026 · Tags: Denial of service
- [Improper access control in Open-Xchange GmbH OX Dovecot Pro](https://agentprime.io/advisories/CVE-2026-40020.md)
  `CVE-2026-40020` · CVE record: Open-Xchange GmbH OX Dovecot Pro · CVSS 3.1 Low · Not analysed yet · Published 12 May 2026 · Tags: Broken access control
- [Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro](https://agentprime.io/advisories/CVE-2026-40016.md)
  `CVE-2026-40016` · CVE record: Open-Xchange GmbH OX Dovecot Pro · CVSS 5.3 Medium · Not analysed yet · Published 12 May 2026 · Tags: Denial of service
- [Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding.](https://agentprime.io/advisories/CVE-2026-33603.md)
  `CVE-2026-33603` · CVE record: Open-Xchange GmbH OX Dovecot Pro · CVSS 6.8 Medium · Not analysed yet · Published 12 May 2026 · Tags: CWE-99
- [SQL injection in Open-Xchange GmbH OX Dovecot Pro](https://agentprime.io/advisories/CVE-2026-27851.md)
  `CVE-2026-27851` · CVE record: Open-Xchange GmbH OX Dovecot Pro · CVSS 7.4 High · Not analysed yet · Published 12 May 2026 · Tags: SQL injection, CWE-235
- [LDAP injection in Open-Xchange GmbH OX Dovecot Pro](https://agentprime.io/advisories/CVE-2026-27860.md)
  `CVE-2026-27860` · CVE record: Open-Xchange GmbH OX Dovecot Pro · CVSS 3.7 Low · Not analysed yet · Published 27 Mar 2026 · Tags: Other injection
- [Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro](https://agentprime.io/advisories/CVE-2026-27859.md)
  `CVE-2026-27859` · CVE record: Open-Xchange GmbH OX Dovecot Pro · CVSS 5.3 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro](https://agentprime.io/advisories/CVE-2026-27858.md)
  `CVE-2026-27858` · CVE record: Open-Xchange GmbH OX Dovecot Pro · CVSS 7.5 High · Not analysed yet · Published 27 Mar 2026 · Tags: Denial of service
- [Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro](https://agentprime.io/advisories/CVE-2026-27857.md)
  `CVE-2026-27857` · CVE record: Open-Xchange GmbH OX Dovecot Pro · CVSS 4.3 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: Denial of service
- [Improper authentication in Open-Xchange GmbH OX Dovecot Pro](https://agentprime.io/advisories/CVE-2026-27856.md)
  `CVE-2026-27856` · CVE record: Open-Xchange GmbH OX Dovecot Pro · CVSS 7.4 High · Not analysed yet · Published 27 Mar 2026 · Tags: Authentication bypass, CWE-208
- [Authentication bypass by replay in Open-Xchange GmbH OX Dovecot Pro](https://agentprime.io/advisories/CVE-2026-27855.md)
  `CVE-2026-27855` · CVE record: Open-Xchange GmbH OX Dovecot Pro · CVSS 6.8 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: Authentication bypass
- [SQL injection in Open-Xchange GmbH OX Dovecot Pro](https://agentprime.io/advisories/CVE-2026-24031.md)
  `CVE-2026-24031` · CVE record: Open-Xchange GmbH OX Dovecot Pro · CVSS 7.7 High · Not analysed yet · Published 27 Mar 2026 · Tags: SQL injection
- [Path traversal in Open-Xchange GmbH OX Dovecot Pro](https://agentprime.io/advisories/CVE-2026-0394.md)
  `CVE-2026-0394` · CVE record: Open-Xchange GmbH OX Dovecot Pro · CVSS 5.3 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: Path traversal
- [Improper input validation in Open-Xchange GmbH OX Dovecot Pro](https://agentprime.io/advisories/CVE-2025-59032.md)
  `CVE-2025-59032` · CVE record: Open-Xchange GmbH OX Dovecot Pro · CVSS 7.5 High · Not analysed yet · Published 27 Mar 2026 · Tags: CWE-20, CWE-229
- [Information disclosure in Open-Xchange GmbH OX Dovecot Pro](https://agentprime.io/advisories/CVE-2025-59031.md)
  `CVE-2025-59031` · CVE record: Open-Xchange GmbH OX Dovecot Pro · CVSS 4.3 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: Information disclosure
- [Improper input validation in Open-Xchange GmbH OX Dovecot Pro](https://agentprime.io/advisories/CVE-2025-59028.md)
  `CVE-2025-59028` · CVE record: Open-Xchange GmbH OX Dovecot Pro · CVSS 5.3 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: CWE-20
- [When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users.](https://agentprime.io/advisories/CVE-2025-30189.md)
  `CVE-2025-30189` · CVE record: Open-Xchange GmbH OX Dovecot Pro · CVSS 7.4 High · Not analysed yet · Published 31 Oct 2025 · Tags: CWE-1250
- [Resource allocation without limits in Open-Xchange GmbH OX Dovecot Pro](https://agentprime.io/advisories/CVE-2024-23185.md)
  `CVE-2024-23185` · CVE record: Open-Xchange GmbH OX Dovecot Pro · CVSS 7.5 High · Not analysed yet · Published 10 Sept 2024 · Tags: Denial of service
- [Resource allocation without limits in Open-Xchange GmbH OX Dovecot Pro](https://agentprime.io/advisories/CVE-2024-23184.md)
  `CVE-2024-23184` · CVE record: Open-Xchange GmbH OX Dovecot Pro · CVSS 5.0 Medium · Not analysed yet · Published 10 Sept 2024 · Tags: Denial of service
- [Insufficient verification of data authenticity in Open-Xchange GmbH OX Dovecot Pro](https://agentprime.io/advisories/CVE-2024-25584.md)
  `CVE-2024-25584` · CVE record: Open-Xchange GmbH OX Dovecot Pro · CVSS 5.3 Medium · Not analysed yet · Published 6 Sept 2024 · Tags: CWE-345

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=open-xchange-gmbh-ox-dovecot-pro>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/open-xchange-gmbh-ox-dovecot-pro/>. Everything for agents: <https://agentprime.io/llms.txt>.