Ox Dovecot Pro
44 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Ox Dovecot Pro, a product in the communications space. Use it to gauge the current risk picture and drill into individual advisories.
Ox Dovecot Pro CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 1 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 11 |
| 2026-04 | 0 |
| 2026-05 | 5 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 24 |
| 2026-09 | 0 |
Severity
How the 44 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical1
- High12
- Medium25
- Low6
Latest CVEs
The 15 most recently published vulnerabilities affecting Ox Dovecot Pro.
- CVE-2026-73209An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradat...6.5
- CVE-2026-73208An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and c...7.4
- CVE-2026-52687An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections. The...6.5
- CVE-2026-52681Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script. Compiled script files are al...3.1
- CVE-2026-42395A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can ca...4.3
- CVE-2026-42393The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm serv...3.1
- CVE-2026-42392An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory conte...4.3
- CVE-2026-42391An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can...7.5
- CVE-2026-42008Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal auth...4.3
- CVE-2026-42007An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended bu...9.1
- CVE-2026-40205An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation pat...5.9
- CVE-2026-40204None None None No publicly available exploits are known.3.1
- CVE-2026-40203When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail and other mail in the same mailbox. An ...3.7
- CVE-2026-40018None None None No publicly available exploits are known.7.4
- CVE-2026-40017An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to...6.5
Product grouping is registry-driven, with AI assist and human review. How it works