Open-Xchange Gmbh Ox Dovecot Ce
20 CVEs affecting Open-Xchange Gmbh Ox Dovecot Ce. Latest disclosed: 2026-08-28. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-42007 | Critical | 9.1 | 2026-08-28 | An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write… |
CVE-2026-42391 | High | 7.5 | 2026-08-28 | An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow dis… |
CVE-2026-73208 | High | 7.4 | 2026-08-28 | An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the aud… |
CVE-2026-40018 | High | 7.4 | 2026-08-28 | None None None No publicly available exploits are known. |
CVE-2026-73209 | Medium | 6.5 | 2026-08-28 | An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process i… |
CVE-2026-52687 | Medium | 6.5 | 2026-08-28 | An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory… |
CVE-2026-40017 | Medium | 6.5 | 2026-08-28 | An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD c… |
CVE-2026-40014 | Medium | 6.5 | 2026-08-28 | An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message… |
CVE-2026-40205 | Medium | 5.9 | 2026-08-28 | An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configur… |
CVE-2026-40019 | Medium | 5.9 | 2026-08-28 | An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This… |
CVE-2026-33604 | Medium | 5.9 | 2026-08-28 | An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body… |
CVE-2026-42395 | Medium | 4.3 | 2026-08-28 | A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The log… |
CVE-2026-42392 | Medium | 4.3 | 2026-08-28 | An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response return… |
CVE-2026-42008 | Medium | 4.3 | 2026-08-28 | Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that ho… |
CVE-2026-40015 | Medium | 4.3 | 2026-08-28 | An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermittently cause an out… |
CVE-2026-40013 | Medium | 4.3 | 2026-08-28 | An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSiev… |
CVE-2026-40203 | Low | 3.7 | 2026-08-28 | When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail a… |
CVE-2026-52681 | Low | 3.1 | 2026-08-28 | Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the activ… |
CVE-2026-42393 | Low | 3.1 | 2026-08-28 | The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access t… |
CVE-2026-40204 | Low | 3.1 | 2026-08-28 | None None None No publicly available exploits are known. |