TI-2026-25988 Aliases CVE-2026-33606 GHSA-wf8m-g4w9-3rc5

Mail content stored by a user can be crafted so that it is interpreted as dsync protocol…

LOW 22CWE-93Published 2026-08-28 · Updated 2026-08-28

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Partial Red Hat: 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, including internal mailbox attributes that a user should not be able to set directly. It can also cause dsync errors. Avoid running dsync with the stream protocol on mailboxes with untrusted content. Update to non-vulnerable version. No publicly available exploits are known.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00246 15th percentileScored 2026-11-07

Fix Partial OX Dovecot Pro (Open-Xchange GmbH): 2.3.22.2, 3.0.7, 3.1.6OX Dovecot CE (Open-Xchange GmbH): 2.4.5Red Hat: 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Open-Xchange GmbH	OX Dovecot Pro	2.3.0 to before 2.3.22.2; 3.0.0 to before 3.0.7; 3.1.0 to before 3.1.6	2.3.22.2, 3.0.7, 3.1.6	Patch available	CNA
Open-Xchange GmbH	OX Dovecot CE	2.3.0 to before 2.4.5	2.4.5	Patch available	CNA

OX Dovecot Pro VendorOpen-Xchange GmbH Affected 2.3.0 to before 2.3.22.2; 3.0.0 to before 3.0.7; 3.1.0 to before 3.1.6 Fixed in 2.3.22.2, 3.0.7, 3.1.6 Patch available CNA
OX Dovecot CE VendorOpen-Xchange GmbH Affected 2.3.0 to before 2.4.5 Fixed in 2.4.5 Patch available CNA

Remediation

Fix · CNA OX Dovecot Pro (Open-Xchange GmbH) Fixed in 2.3.22.2, 3.0.7, 3.1.6
Fix · CNA OX Dovecot CE (Open-Xchange GmbH) Fixed in 2.4.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2026-08-28
Open-Xchange OX Dovecot CE, OX Dovecot Pro — documentation.open-xchange.com/dovecot/security/advisories/…
25 records Highest priority Priority LOW 25 LOW
Other records, highest priority first
- TI-2026-30691 Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot ProPriority LOW 39
- TI-2026-30395 Use after free in Open-Xchange GmbH OX Dovecot ProPriority LOW 39
- TI-2026-25987 Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot ProPriority LOW 39
Show all 25 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-33606
2026-10-03 Alias added: GHSA-wf8m-g4w9-3rc5

References

Advisory 1

https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json

TI-2024-04069 Improper check for unusual conditions in Mozilla Firefox CVSS 3.1HIGH 8.8
TI-2022-17394 OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only… CVSS 3.1MEDIUM 5.3
TI-2022-17393 OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request… CVSS 3.1MEDIUM 5.3
TI-2022-17392 OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location… CVSS 3.1MEDIUM 5.3
TI-2022-17391 OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help… CVSS 3.1MEDIUM 6.1
TI-2022-17390 OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name. CVSS 3.1MEDIUM 6.1

See all 317 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences