Executive brief
OX Dovecot is an email server used to handle incoming and outgoing messages for organizations. When the connection limit per IP address is reached (default 10), a file descriptor handling flaw causes the submission-login process to crash. Depending on the deployment mode, either a single new connection or all connections on that process are terminated, disrupting email sending and potentially causing duplicate message deliveries. Organizations may experience email delivery failures and data loss.
Technical details
The vulnerability is a denial-of-service flaw in OX Dovecot's submission-login component triggered when mail_max_userip_connections limit is reached. The root cause is improper file descriptor handling in epoll() event loop management, leading to process panic and termination. Attack vector is network-based; an attacker can trigger this by exhausting the per-IP connection limit through repeated connection attempts. In high-security mode (community releases), only the new connection terminates; in high-performance mode (Pro releases), all connections on that process are killed. This can result in failed message delivery or duplicate message transmission, particularly when TLS is used on the backend. Patches are available in OX Dovecot Pro 2.3.22.2, 3.0.7, and 3.1.6.
Affected products
- Open-Xchange Dovecot Pro 2.3.0 to 2.3.22.1, 3.0.0 to 3.0.6, 3.1.0 to 3.1.5
Timeline
- 2026-08-26: disclosed: Initial security advisory release
- 2026-08-28: advisory: Public release of advisory OXDC-ADV-2026-0003
- 2026-08-28: patched: Patches available in OX Dovecot Pro 2.3.22.2, 3.0.7, and 3.1.6