CVE-2026-33606: open-xchange gmbh ox dovecot ce CRLF Injection

Vulnerability summary

CVE-2026-33606 is a medium (CVSS 4.8) CRLF Injection vulnerability in open-xchange gmbh ox dovecot ce. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 14.9% of scored vulnerabilities.

Timeline

1. 28-08-2026
   PublishedVulnerability first disclosed.
2. 28-08-2026
   Last modifiedVulnerability information updated.

Description

Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, including internal mailbox attributes that a user should not be able to set directly. It can also cause dsync errors. Avoid running dsync with the stream protocol on mailboxes with untrusted content. Update to non-vulnerable version. No publicly available exploits are known.

• CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.