Open-xchange Gmbh vulnerabilities
77 CVEs and advisories name Open-xchange Gmbh as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-73209An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash.
- CVE-2026-73208An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a s
- CVE-2026-52687An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large
- CVE-2026-52681Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly
- CVE-2026-42395A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following log
- CVE-2026-42393The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret.
- CVE-2026-42392An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the er
- CVE-2026-42391An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CP
- CVE-2026-42008Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a va
- CVE-2026-42007An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing
- CVE-2026-40205An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is requi
- CVE-2026-40204None None None No publicly available exploits are known.
- CVE-2026-40203When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attac
- CVE-2026-40019An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop c
- CVE-2026-40018None None None No publicly available exploits are known.
- CVE-2026-40017An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which make
- CVE-2026-40015An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermit
- CVE-2026-40014An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the s
- CVE-2026-40013An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write
- CVE-2026-33607An attacker that has valid credentials can use IMAP LIST command to consume CPU.
- CVE-2026-33606Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync wit
- CVE-2026-33605An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating.
- CVE-2026-33604An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending i
- CVE-2026-33263When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor ha
- CVE-2026-27852An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters
- CVE-2026-42006An attacker can cause uncontrolled memory usage with excessive bracing over IMAP.
- CVE-2026-40020Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no.
- CVE-2026-40016Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130
- CVE-2026-33603Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding.
- CVE-2026-27851When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabli