Timing Oracle Vulnerability in Dovecot by Open-Xchange

CVE-2026-27856

What is CVE-2026-27856?

The vulnerability in Dovecot arises from the insecure handling of doveadm credentials through direct comparison, making it vulnerable to timing oracle attacks. This allows potential attackers to exploit timing discrepancies to infer valid credentials. Should the credentials be compromised, it could grant unauthorized access to sensitive components of the system. To mitigate this risk, it is recommended to restrict access to the doveadm HTTP service port and to upgrade to the fixed version as soon as possible. Currently, there are no publicly available exploits for this vulnerability.

References