Is CVE-2026-33263 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33263 being exploited in the wild.

How severe is CVE-2026-33263?

Medium severity, with a CVSS score of 4.3, published 28 August 2026.

Which products and versions are affected?

Open-Xchange Dovecot Pro 2.3.0 to 2.3.22.1, 3.0.0 to 3.0.6, 3.1.0 to 3.1.5.

Is there a fix for CVE-2026-33263?

A patch was published on 2026-08-28: Patches available in OX Dovecot Pro 2.3.22.2, 3.0.7, and 3.1.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33263 attacked?

It is attacked over the network.

Am I affected by CVE-2026-33263?

Check whether you run Open-Xchange Dovecot Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33263: OX Dovecot submission-login denial of service via file descriptor handling

CVE-2026-33263 · Severity: medium · CVSS 4.3 · Published 2026-08-28

OX Dovecot is an email server used to handle incoming and outgoing messages for organizations. When the connection limit per IP address is reached (default 10), a file descriptor handling flaw causes the submission-login process to crash. Depending on the deployment mode, either a single new connection or all connections on that process are terminated, disrupting email sending and potentially causing duplicate message deliveries. Organizations may experience email delivery failures and data loss.

Technologies: Open-Xchange Dovecot Pro. Vendors: Open-Xchange.

Quick answers

Is CVE-2026-33263 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33263 being exploited in the wild.
How severe is CVE-2026-33263?: Medium severity, with a CVSS score of 4.3, published 28 August 2026.
Which products and versions are affected?: Open-Xchange Dovecot Pro 2.3.0 to 2.3.22.1, 3.0.0 to 3.0.6, 3.1.0 to 3.1.5.
Is there a fix for CVE-2026-33263?: A patch was published on 2026-08-28: Patches available in OX Dovecot Pro 2.3.22.2, 3.0.7, and 3.1.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33263 attacked?: It is attacked over the network.
Am I affected by CVE-2026-33263?: Check whether you run Open-Xchange Dovecot Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a denial-of-service flaw in OX Dovecot's submission-login component triggered when mail_max_userip_connections limit is reached. The root cause is improper file descriptor handling in epoll() event loop management, leading to process panic and termination. Attack vector is network-based; an attacker can trigger this by exhausting the per-IP connection limit through repeated connection attempts. In high-security mode (community releases), only the new connection terminates; in high-performance mode (Pro releases), all connections on that process are killed. This can result in failed message delivery or duplicate message transmission, particularly when TLS is used on the backend. Patches are available in OX Dovecot Pro 2.3.22.2, 3.0.7, and 3.1.6.

Affected products

Open-Xchange Dovecot Pro 2.3.0 to 2.3.22.1, 3.0.0 to 3.0.6, 3.1.0 to 3.1.5

Timeline

2026-08-26: disclosed: Initial security advisory release
2026-08-28: advisory: Public release of advisory OXDC-ADV-2026-0003
2026-08-28: patched: Patches available in OX Dovecot Pro 2.3.22.2, 3.0.7, and 3.1.6

References

https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.