https://vulnogram.org/ Most recent CVEs assigned by Open-Xchange (ox). https://vulnogram.org/seaview/icons/ox.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-73209 https://vulnogram.org/CVE-2026-73209 An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vuln… Medium Fri, 28 Aug 2026 10:12:33 GMT https://vulnogram.org/CVE-2026-73208 https://vulnogram.org/CVE-2026-73208 An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These… High Network Exploitable Fri, 28 Aug 2026 10:12:32 GMT https://vulnogram.org/CVE-2026-52687 https://vulnogram.org/CVE-2026-52687 An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections. The memory limit of the process is reached with only a f… Medium Fri, 28 Aug 2026 10:12:31 GMT https://vulnogram.org/CVE-2026-52681 https://vulnogram.org/CVE-2026-52681 Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script. Compiled script files are also not removed when a script is deleted or renamed. T… Low Fri, 28 Aug 2026 10:12:30 GMT https://vulnogram.org/CVE-2026-42395 https://vulnogram.org/CVE-2026-42395 A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Depl… Medium Fri, 28 Aug 2026 10:12:29 GMT https://vulnogram.org/CVE-2026-42393 https://vulnogram.org/CVE-2026-42393 The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure respo… Low Fri, 28 Aug 2026 10:12:28 GMT https://vulnogram.org/CVE-2026-42392 https://vulnogram.org/CVE-2026-42392 An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include… Medium Fri, 28 Aug 2026 10:12:27 GMT https://vulnogram.org/CVE-2026-42391 https://vulnogram.org/CVE-2026-42391 An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which a… High Network Exploitable Fri, 28 Aug 2026 10:12:27 GMT https://vulnogram.org/CVE-2026-42008 https://vulnogram.org/CVE-2026-42008 Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trus… Medium Fri, 28 Aug 2026 10:12:26 GMT https://vulnogram.org/CVE-2026-42007 https://vulnogram.org/CVE-2026-42007 An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak… Critical Fri, 28 Aug 2026 10:12:25 GMT https://vulnogram.org/CVE-2026-40205 https://vulnogram.org/CVE-2026-40205 An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, whil… Medium Fri, 28 Aug 2026 10:12:24 GMT https://vulnogram.org/CVE-2026-40204 https://vulnogram.org/CVE-2026-40204 None None None No publicly available exploits are known. Low Fri, 28 Aug 2026 10:12:23 GMT https://vulnogram.org/CVE-2026-40203 https://vulnogram.org/CVE-2026-40203 When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail and other mail in the same mailbox. An attacker that can send mail to a user and can also ob… Low Network Exploitable Fri, 28 Aug 2026 10:12:22 GMT https://vulnogram.org/CVE-2026-40019 https://vulnogram.org/CVE-2026-40019 An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can cause degradation or denial of service for Sieve script management, and repeated connec… Medium Network Exploitable Fri, 28 Aug 2026 10:12:21 GMT https://vulnogram.org/CVE-2026-40018 https://vulnogram.org/CVE-2026-40018 None None None No publicly available exploits are known. High Network Exploitable Fri, 28 Aug 2026 10:12:20 GMT https://vulnogram.org/CVE-2026-40017 https://vulnogram.org/CVE-2026-40017 An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue fr… Medium Network Exploitable Fri, 28 Aug 2026 10:12:19 GMT https://vulnogram.org/CVE-2026-40015 https://vulnogram.org/CVE-2026-40015 An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermittently cause an out-of-bounds read and crash the process. The crash interrupts hibernated IMAP sessions handle… Medium Fri, 28 Aug 2026 10:12:18 GMT https://vulnogram.org/CVE-2026-40014 https://vulnogram.org/CVE-2026-40014 An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degrada… Medium Network Exploitable Fri, 28 Aug 2026 10:12:17 GMT https://vulnogram.org/CVE-2026-40013 https://vulnogram.org/CVE-2026-40013 An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script. This causes memory corruption and an observed crash of the M… Medium Fri, 28 Aug 2026 10:12:16 GMT https://vulnogram.org/CVE-2026-33607 https://vulnogram.org/CVE-2026-33607 An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fi… Medium Fri, 28 Aug 2026 10:12:15 GMT https://vulnogram.org/CVE-2026-33606 https://vulnogram.org/CVE-2026-33606 Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the desti… Medium Fri, 28 Aug 2026 10:12:14 GMT https://vulnogram.org/CVE-2026-33605 https://vulnogram.org/CVE-2026-33605 An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode (default for community releases), only the attacker's own connection is terminated. If ru… High Network Exploitable Fri, 28 Aug 2026 10:12:13 GMT https://vulnogram.org/CVE-2026-33604 https://vulnogram.org/CVE-2026-33604 An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as S… Medium Network Exploitable Fri, 28 Aug 2026 10:12:12 GMT https://vulnogram.org/CVE-2026-33263 https://vulnogram.org/CVE-2026-33263 When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. If running in high-security mode (default for community releases), only the new submission conn… Medium Fri, 28 Aug 2026 10:12:12 GMT https://vulnogram.org/CVE-2026-27852 https://vulnogram.org/CVE-2026-27852 An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but re… High Network Exploitable Fri, 28 Aug 2026 10:12:11 GMT https://vulnogram.org/CVE-2026-52688 https://vulnogram.org/CVE-2026-52688 RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation High Network Exploitable Thu, 23 Jul 2026 08:03:58 GMT https://vulnogram.org/CVE-2026-52686 https://vulnogram.org/CVE-2026-52686 The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record. Low Network Exploitable Thu, 23 Jul 2026 08:03:37 GMT https://vulnogram.org/CVE-2026-52684 https://vulnogram.org/CVE-2026-52684 If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or th… Low Network Exploitable Thu, 23 Jul 2026 07:49:04 GMT https://vulnogram.org/CVE-2026-42389 https://vulnogram.org/CVE-2026-42389 This fix provides extra hardening for the 5.4.x branch by doing extra validation of incoming answers from authoritative servers. Medium Network Exploitable Thu, 25 Jun 2026 13:16:45 GMT https://vulnogram.org/CVE-2026-52690 https://vulnogram.org/CVE-2026-52690 Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, causing valdiation of DNSSEC records served by that server to fail. Medium Network Exploitable Thu, 25 Jun 2026 13:01:40 GMT https://vulnogram.org/CVE-2026-42390 https://vulnogram.org/CVE-2026-42390 An invalid zone might pass ZONEMD validation while it should not. This is only relevant if ZoneToCache is configured with ZONEMD validation. Medium Network Exploitable Thu, 25 Jun 2026 13:01:08 GMT https://vulnogram.org/CVE-2026-42388 https://vulnogram.org/CVE-2026-42388 Incomplete validation of the SOA record present in a catalog zone might lead to a crash. Medium Network Exploitable Thu, 25 Jun 2026 12:59:38 GMT https://vulnogram.org/CVE-2026-42387 https://vulnogram.org/CVE-2026-42387 A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to a crash of the Recursor due to insuffcient input validation. Medium Network Exploitable Thu, 25 Jun 2026 12:59:16 GMT https://vulnogram.org/CVE-2026-40012 https://vulnogram.org/CVE-2026-40012 ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled; Medium Network Exploitable Thu, 25 Jun 2026 12:58:51 GMT https://vulnogram.org/CVE-2026-33612 https://vulnogram.org/CVE-2026-33612 A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to cache poisoning. High Network Exploitable Thu, 25 Jun 2026 12:58:27 GMT https://vulnogram.org/CVE-2026-42004 https://vulnogram.org/CVE-2026-42004 An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filt… Low Network Exploitable Thu, 25 Jun 2026 12:24:20 GMT https://vulnogram.org/CVE-2026-40211 https://vulnogram.org/CVE-2026-40211 An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough co… Medium Network Exploitable Thu, 25 Jun 2026 12:23:55 GMT https://vulnogram.org/CVE-2026-40210 https://vulnogram.org/CVE-2026-40210 An out-of-bounds read might happen when SetMacAddrAction is used, potentially resulting in uninitialized memory being sent over the network or a crash. Medium Network Exploitable Thu, 25 Jun 2026 12:23:31 GMT https://vulnogram.org/CVE-2026-40209 https://vulnogram.org/CVE-2026-40209 An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFR queries. This could be used to cause a denial of service if there is a limit to the numbe… Medium Network Exploitable Thu, 25 Jun 2026 12:23:05 GMT https://vulnogram.org/CVE-2026-40208 https://vulnogram.org/CVE-2026-40208 An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame. Low Network Exploitable Thu, 25 Jun 2026 12:22:42 GMT https://vulnogram.org/CVE-2026-40011 https://vulnogram.org/CVE-2026-40011 An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scra… Low Network Exploitable Thu, 25 Jun 2026 12:22:19 GMT https://vulnogram.org/CVE-2026-42005 https://vulnogram.org/CVE-2026-42005 An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default. Medium Thu, 25 Jun 2026 11:57:16 GMT https://vulnogram.org/CVE-2026-41999 https://vulnogram.org/CVE-2026-41999 Incorrect Behaviour of Views with TCP PROXY Requests Medium Network Exploitable Thu, 21 May 2026 09:27:26 GMT https://vulnogram.org/CVE-2026-42002 https://vulnogram.org/CVE-2026-42002 Concurrency and locking defects in GSS-TSIG Medium Network Exploitable Thu, 21 May 2026 09:27:04 GMT https://vulnogram.org/CVE-2026-42001 https://vulnogram.org/CVE-2026-42001 Insufficient Validation of Autoprimary SOA Queries High Network Exploitable Thu, 21 May 2026 09:26:38 GMT https://vulnogram.org/CVE-2026-42000 https://vulnogram.org/CVE-2026-42000 Insufficient Validation of Names During AXFR Medium Network Exploitable Thu, 21 May 2026 09:25:43 GMT https://vulnogram.org/CVE-2026-42396 https://vulnogram.org/CVE-2026-42396 Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail Medium Thu, 21 May 2026 09:25:03 GMT https://vulnogram.org/CVE-2026-42006 https://vulnogram.org/CVE-2026-42006 An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces,… High Network Exploitable Tue, 12 May 2026 13:28:46 GMT https://vulnogram.org/CVE-2026-40020 https://vulnogram.org/CVE-2026-40020 Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be spammed to all users. The impact is limited to being able to spam folders to other users,… Low Tue, 12 May 2026 13:28:46 GMT https://vulnogram.org/CVE-2026-40016 https://vulnogram.org/CVE-2026-40016 Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the configured limit. Attacker can use this to degrade server performance and bypass configured CPU t… Medium Tue, 12 May 2026 13:28:45 GMT