Advisories · Technology

Open-Xchange GmbH OX Dovecot Pro.

Every CVE that names Open-Xchange GmbH OX Dovecot Pro among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-73209 CVE record

CVSS 6.5 Medium

Uncontrolled recursion in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Denial of service
Not analysed yet 28 Aug 2026
CVE-2026-73208 CVE record

CVSS 7.4 High

Improper authentication in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Authentication bypass
Not analysed yet 28 Aug 2026
CVE-2026-52687 CVE record

CVSS 6.5 Medium

Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Denial of service
Not analysed yet 28 Aug 2026
CVE-2026-52681 CVE record

CVSS 3.1 Low

Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script.
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- CWE-1050
Not analysed yet 28 Aug 2026
CVE-2026-42395 CVE record

CVSS 4.3 Medium

Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Denial of service
Not analysed yet 28 Aug 2026
CVE-2026-42393 CVE record

CVSS 3.1 Low

Information disclosure in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Information disclosure
Not analysed yet 28 Aug 2026
CVE-2026-42392 CVE record

CVSS 4.3 Medium

Information disclosure in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Information disclosure
Not analysed yet 28 Aug 2026
CVE-2026-42391 CVE record

CVSS 7.5 High

Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Denial of service
Not analysed yet 28 Aug 2026
CVE-2026-42008 CVE record

CVSS 4.3 Medium

Improper authentication in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Authentication bypass
Not analysed yet 28 Aug 2026
CVE-2026-42007 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Use after free in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Memory corruption
Not analysed yet 28 Aug 2026
CVE-2026-40205 CVE record

CVSS 5.9 Medium

Improper authentication in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Authentication bypass
Not analysed yet 28 Aug 2026
CVE-2026-40204 CVE record

CVSS 3.1 Low

Improper access control in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Broken access control
Not analysed yet 28 Aug 2026
CVE-2026-40203 CVE record

CVSS 3.7 Low

Information disclosure in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Information disclosure
Not analysed yet 28 Aug 2026
CVE-2026-40018 CVE record

CVSS 7.4 High

SQL injection in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- SQL injection
Not analysed yet 28 Aug 2026
CVE-2026-40017 CVE record

CVSS 6.5 Medium

Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Denial of service
Not analysed yet 28 Aug 2026
CVE-2026-40015 CVE record

CVSS 4.3 Medium

Out-of-bounds read in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Memory corruption
Not analysed yet 28 Aug 2026
CVE-2026-40014 CVE record

CVSS 6.5 Medium

Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Denial of service
Not analysed yet 28 Aug 2026
CVE-2026-40013 CVE record

CVSS 4.3 Medium

An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script.
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Memory corruption
Not analysed yet 28 Aug 2026
CVE-2026-33607 CVE record

CVSS 4.3 Medium

Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Denial of service
Not analysed yet 28 Aug 2026
CVE-2026-33606 CVE record

CVSS 4.8 Medium

CRLF injection in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Other injection
Not analysed yet 28 Aug 2026
CVE-2026-33605 CVE record

CVSS 7.5 High

Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Denial of service
Not analysed yet 28 Aug 2026
CVE-2026-33604 CVE record

CVSS 5.9 Medium

An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that p…
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- CWE-655
Not analysed yet 28 Aug 2026
CVE-2026-33263 CVE record

CVSS 4.3 Medium

When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues.
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- CWE-403
Not analysed yet 28 Aug 2026
CVE-2026-27852 CVE record

CVSS 7.5 High

Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro and others
- Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot CE
- Denial of service
Not analysed yet 28 Aug 2026
CVE-2026-42006 CVE record

CVSS 4.3 Medium

Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot Pro
- Denial of service
Not analysed yet 12 May 2026
CVE-2026-40020 CVE record

CVSS 3.1 Low

Improper access control in Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot Pro
- Broken access control
Not analysed yet 12 May 2026
CVE-2026-40016 CVE record

CVSS 5.3 Medium

Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot Pro
- Denial of service
Not analysed yet 12 May 2026
CVE-2026-33603 CVE record

CVSS 6.8 Medium

Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding.
- Open-Xchange GmbH OX Dovecot Pro
- CWE-99
Not analysed yet 12 May 2026
CVE-2026-27851 CVE record

CVSS 7.4 High

SQL injection in Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot Pro
- SQL injection
- CWE-235
Not analysed yet 12 May 2026
CVE-2026-27860 CVE record

CVSS 3.7 Low

LDAP injection in Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot Pro
- Other injection
Not analysed yet 27 Mar 2026
CVE-2026-27859 CVE record

CVSS 5.3 Medium

Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot Pro
- Denial of service
Not analysed yet 27 Mar 2026
CVE-2026-27858 CVE record

CVSS 7.5 High

Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot Pro
- Denial of service
Not analysed yet 27 Mar 2026
CVE-2026-27857 CVE record

CVSS 4.3 Medium

Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot Pro
- Denial of service
Not analysed yet 27 Mar 2026
CVE-2026-27856 CVE record

CVSS 7.4 High

Improper authentication in Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot Pro
- Authentication bypass
- CWE-208
Not analysed yet 27 Mar 2026
CVE-2026-27855 CVE record

CVSS 6.8 Medium

Authentication bypass by replay in Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot Pro
- Authentication bypass
Not analysed yet 27 Mar 2026
CVE-2026-24031 CVE record

CVSS 7.7 High

SQL injection in Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot Pro
- SQL injection
Not analysed yet 27 Mar 2026
CVE-2026-0394 CVE record

CVSS 5.3 Medium

Path traversal in Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot Pro
- Path traversal
Not analysed yet 27 Mar 2026
CVE-2025-59032 CVE record

CVSS 7.5 High

Improper input validation in Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot Pro
- CWE-20
- CWE-229
Not analysed yet 27 Mar 2026
CVE-2025-59031 CVE record

CVSS 4.3 Medium

Information disclosure in Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot Pro
- Information disclosure
Not analysed yet 27 Mar 2026
CVE-2025-59028 CVE record

CVSS 5.3 Medium

Improper input validation in Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot Pro
- CWE-20
Not analysed yet 27 Mar 2026
CVE-2025-30189 CVE record

CVSS 7.4 High

When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users.
- Open-Xchange GmbH OX Dovecot Pro
- CWE-1250
Not analysed yet 31 Oct 2025
CVE-2024-23185 CVE record

CVSS 7.5 High

Resource allocation without limits in Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot Pro
- Denial of service
Not analysed yet 10 Sept 2024
CVE-2024-23184 CVE record

CVSS 5.0 Medium

Resource allocation without limits in Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot Pro
- Denial of service
Not analysed yet 10 Sept 2024
CVE-2024-25584 CVE record

CVSS 5.3 Medium

Insufficient verification of data authenticity in Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot Pro
- CWE-345
Not analysed yet 6 Sept 2024