Search
Search Results (25 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-42392 | 1 Open-xchange | 2 Ox Dovecot Ce, Ox Dovecot Pro | 2026-09-01 | 4.3 Medium |
| An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH functionality. Update to non-vulnerable version. No publicly available exploits are known. | ||||
| CVE-2026-42393 | 1 Open-xchange | 2 Ox Dovecot Ce, Ox Dovecot Pro | 2026-09-01 | 3.1 Low |
| The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of the secret, which reduces the effort needed to guess it. The secret value itself is not disclosed. Restrict network access to the doveadm service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known. | ||||
| CVE-2026-42395 | 1 Open-xchange | 2 Ox Dovecot Ce, Ox Dovecot Pro | 2026-09-01 | 4.3 Medium |
| A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known. | ||||
| CVE-2026-52681 | 1 Open-xchange | 2 Ox Dovecot Ce, Ox Dovecot Pro | 2026-09-01 | 3.1 Low |
| Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script. Compiled script files are also not removed when a script is deleted or renamed. The configured Sieve CPU limit can be bypassed, allowing sustained CPU consumption, and the leftover files increase disk consumption. Both can cause degradation of service for mail delivery. Monitor system for abnormal CPU usage and disk consumption. Update to non-vulnerable version. No publicly available exploits are known. | ||||
| CVE-2026-52687 | 1 Open-xchange | 2 Ox Dovecot Ce, Ox Dovecot Pro | 2026-09-01 | 6.5 Medium |
| An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections. The memory limit of the process is reached with only a few connections, terminating the process and all connections it handles, which can cause degradation or denial of service for IMAP. Disable IMAP compression. Alternatively limit the number of connections handled by a single imap-login process, though this has a performance impact. Update to non-vulnerable version. No publicly available exploits are known. | ||||