Skip to contentOpen-xchange Gmbh Ox Dovecot Ce vulnerabilities
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn attacker that has valid credentials can send crafted compressed data that causes the affected...CVE-2026-73209Fix available6.5 Medium
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn attacker that holds a token intended for a different purpose can authenticate, because when an...CVE-2026-73208Fix available7.4 High
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn attacker that has valid credentials can select a compression algorithm for the IMAP connection...CVE-2026-52687Fix available6.5 Medium
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreSieve CPU resource usage is tracked in the compiled script, so an attacker that has valid...CVE-2026-52681Fix available3.1 Low
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreA host listed as a trusted proxy can send forwarding information containing a NUL byte, which...CVE-2026-42395Fix available4.3 Medium
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreThe comparison used for the doveadm password and API key is not fully timing safe and can reveal...CVE-2026-42393Fix available3.1 Low
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes...CVE-2026-42392Fix available4.3 Medium
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn unauthenticated attacker can send an IMAP ID command with a very large number of parameters...CVE-2026-42391Fix available7.5 High
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreForwarding information received from a host listed as a trusted proxy is not kept separate from...CVE-2026-42008Fix available4.3 Medium
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn attacker that has valid credentials can use a Sieve script with the editheader extension to...CVE-2026-42007Fix available9.1 Critical
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn attacker that holds an OAuth2 token granting only part of the required scopes can authenticate...CVE-2026-40205Fix available5.9 Medium
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreNone None None No publicly available exploits are known.CVE-2026-40204Fix available3.1 Low
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreWhen IMAP compression is enabled, the same compression state is reused across responses in a...CVE-2026-40203Fix available3.7 Low
- open-xchange gmbh ox dovecot ceAn unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process...CVE-2026-40019Fix available5.9 Medium
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreNone None None No publicly available exploits are known.CVE-2026-40018Fix available7.4 High
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn attacker that can send mail to a user can craft a message header whose values are chosen to...CVE-2026-40017Fix available6.5 Medium
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn attacker that has valid credentials can open many connections to the imap-hibernate service...CVE-2026-40015Fix available4.3 Medium
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn attacker that can send mail to a user can craft a message header that makes the IMAP THREAD...CVE-2026-40014Fix available6.5 Medium
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn attacker that has valid credentials can submit a Sieve script containing an extreme numeric...CVE-2026-40013Fix available4.3 Medium
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause...CVE-2026-33607Fix available4.3 Medium
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreMail content stored by a user can be crafted so that it is interpreted as dsync protocol commands...CVE-2026-33606Fix available4.8 Medium
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn unauthenticated attacker can crash the ManageSieve login process by sending a small malformed...CVE-2026-33605Fix available7.5 High
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn attacker that can get Dovecot to relay a message, for example through Sieve redirect or...CVE-2026-33604Fix available5.9 Medium
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreWhen mail_max_userip_connections is set (default 10) and reached, submission-login can crash with...CVE-2026-33263Fix available4.3 Medium
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn attacker that can send mail to a user can craft a message whose headers contain a very large...CVE-2026-27852Fix available7.5 High