Executive brief
Dovecot is an open-source email server used by organizations to manage incoming and outgoing mail. An attacker who can trigger message relay through Dovecot features (like Sieve redirect or submission relay) can craft a malicious email with specially formatted line endings that bypass security protections. This allows them to inject fake SMTP commands into downstream mail servers, enabling spoofed or unauthorized emails to be sent through the compromised infrastructure.
Technical details
This is an SMTP smuggling vulnerability (CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers) where a crafted message body with specific line endings bypasses Dovecot's outbound SMTP protection mechanisms. The vulnerability requires attacker control over message relay (via Sieve redirect or submission relay features) and affects downstream mail servers that have not patched CVE-2023-51764 or CVE-2023-51766. An attacker can inject SMTP commands that will be interpreted by the receiving server, enabling email spoofing and message injection attacks. Patches are available in Dovecot versions 2.3.22.2, 3.0.7, and 3.1.6 or later.
Affected products
- Open-Xchange Dovecot 2.3.0 before 2.3.22.2; 3.0.0 before 3.0.7; 3.1.0 before 3.1.6
Timeline
- 2026-08-28: disclosed
- 2026-08-26: advisory: Initial security advisory release