Skip to content
fr Sign in
4.8 Medium

CVE-2026-33606 Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an…

Description

Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, including internal mailbox attributes that a user should not be able to set directly. It can also cause dsync errors. Avoid running dsync with the stream protocol on mailboxes with untrusted content. Update to non-vulnerable version. No publicly available exploits are known.

Affected products and versions

Product Affected versions Fixed in
OX Dovecot Pro 3.1 3.1.0 → < 3.1.6 3.1.6
OX Dovecot Pro 3.0 3.0.0 → < 3.0.7 3.0.7
OX Dovecot Pro 2.3 2.3.0 → < 2.3.22.2 2.3.22.2
OX Dovecot CE 2.3 2.3.0 → < 2.4.5 2.4.5

References

Timeline

  1. Published
  2. Last modified

Other CVEs of OX Dovecot Pro

The 44 CVEs of OX Dovecot Pro →
CVE-2026-73209 An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust… 6.5 Medium CVE-2026-73208 An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token… 7.4 High CVE-2026-52687 An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression… 6.5 Medium CVE-2026-52681 Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the… 3.1 Low
Track this CVE