TI-2026-30394 CVE-2026-42006 · GHSA-h665-fh45-xq6r
Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro
Priority LOW 21
An attacker can cause uncontrolled memory usage with excessive bracing over IMAP.
Vulnerabilities
5 records
Advisory: Open-Xchange OX Dovecot Pro — documentation.open-xchange.com/dovecot/security/advisories/… Clear all filters
TI-2026-28863 CVE-2026-40020 · GHSA-h6rp-9mjf-6x88
Improper access control in Open-Xchange GmbH OX Dovecot Pro
Priority LOW 20
Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no.
TI-2026-28859 CVE-2026-40016 · GHSA-m97m-74mq-mqc6
Uncontrolled resource consumption in Open-Xchange GmbH OX Dovecot Pro
Priority LOW 29
Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the configured limit.
TI-2026-25985 CVE-2026-33603 · GHSA-gxj9-f8v6-q8h3
Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake…
Priority LOW 31
Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding.
TI-2026-22201 CVE-2026-27851 · GHSA-xfpv-rrgm-4qqr
When safe filter is used with variable expansion, all following pipelines on the same…
Priority MEDIUM 41
When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped.