Vulnerability · Published May 12, 2026 · Assigned by OX
CVE-2026-33603
Medium 6.8
In plain English
A medium-severity security flaw in OX Dovecot Pro from Open-Xchange GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to position itself between Dovecot and the client connection. If successful, the attacker can eavesdrop communications between Dovecot and client as MITM proxy. Install fixed version. No publicly available exploits are known.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | dovecot | 2.4.4-r0 | ALPINE-CVE-2026-33603 |
| Alpine:v3.24 | dovecot | 2.4.4-r0 | ALPINE-CVE-2026-33603 |
| Debian:12 | dovecot | 1:2.3.19.1+dfsg1-2.1+deb12u6 | DEBIAN-CVE-2026-33603 |
| Debian:13 | dovecot | 1:2.4.1+dfsg1-6+deb13u6 | DEBIAN-CVE-2026-33603 |
| Debian:14 | dovecot | 1:2.4.4+dfsg1-1 | DEBIAN-CVE-2026-33603 |
| Ubuntu:22.04:LTS | dovecot | 1:2.3.16+dfsg1-3ubuntu2.9 | UBUNTU-CVE-2026-33603 |
| Ubuntu:24.04:LTS | dovecot | 1:2.3.21+dfsg1-2ubuntu6.5 | UBUNTU-CVE-2026-33603 |
| Ubuntu:25.10 | dovecot | 1:2.4.1+dfsg1-5ubuntu4.2 | UBUNTU-CVE-2026-33603 |
| Ubuntu:26.04:LTS | dovecot | 1:2.4.2+dfsg1-3ubuntu2.1 | UBUNTU-CVE-2026-33603 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Open-Xchange GmbH | OX Dovecot Pro | 0 – through 3.1.00 – through 2.4.0 |
Weakness: CWE-99 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N