Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.8
CVE-2026-33606: Dovecot mail migration can be hijacked by crafted messages
CVE-2026-33606 · published 2 months ago
Summary
If a user stores specially crafted email content, an administrator who later runs Dovecot's dsync tool with the stream protocol (common during migration or replication) may unintentionally execute those commands. This can change mailbox settings or cause migration errors. Avoid using the stream protocol on mailboxes that may contain untrusted content and apply the latest Dovecot update that removes the issue.
What to do
- Update debian dovecot to version 1:2.4.5+dfsg1-1.
- Update alpine dovecot to version 2.4.5-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:14 | debian | dovecot |
< 1:2.4.5+dfsg1-1 Fix: upgrade to 1:2.4.5+dfsg1-1
|
| Ubuntu:Pro:14.04:LTS | canonical | dovecot | All versions |
| Debian:11 | debian | dovecot | All versions |
| Debian:12 | debian | dovecot | All versions |
| Debian:13 | debian | dovecot | All versions |
| Alpine:v3.24 | alpine | dovecot |
< 2.4.5-r0 Fix: upgrade to 2.4.5-r0
|
Original advisory text
Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. In...
Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, including internal mailbox attributes that a user should not be able to set directly. It can also cause dsync errors. Avoid running dsync with the stream protocol on mailboxes with untrusted content. Update to non-vulnerable version. No publicly available exploits are known.
References
- https://ubuntu.com/security/CVE-2026-33606 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-33606 Third Party Advisory
- https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxd...
- https://security-tracker.debian.org/tracker/CVE-2026-33606 Vendor Advisory
- https://security.alpinelinux.org/vuln/CVE-2026-33606 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')
Timeline
Published28 Aug 2026
Updated4 Nov 2026
First seen28 Aug 2026
Sources
CVE-2026-33606 · NVD
DEBIAN-CVE-2026-33606 · OSV
ALPINE-CVE-2026-33606 · OSV
UBUNTU-CVE-2026-33606 · OSV
Track software like this
Free during beta