Information Disclosure in Dovecot by Open-Xchange

CVE-2026-42393

What is CVE-2026-42393?

A timing attack vulnerability in Dovecot allows an adjacent attacker to infer the length of a secret used for password and API key comparisons. This can occur when the attacker sends repeated requests and measures response timings. Although the secret value itself is not exposed, knowing its length significantly aids in guessing efforts. To mitigate this risk, it is advisable to restrict network access to the doveadm service to trusted clients only and to update to a non-vulnerable version as soon as possible.

References