Executive brief
Dovecot is an email and authentication service used by organizations to manage mail access and credentials. A timing-based weakness in the doveadm password and API key comparison allows attackers on the same network to measure response times and deduce the length of configured secrets, reducing the computational effort needed to guess credentials. The actual secret values remain protected.
Technical details
The vulnerability is a timing-side-channel attack (CWE-208) in the doveadm password and API key validation logic. The comparison function used is not fully constant-time, allowing an attacker with network proximity and the ability to send repeated requests to measure minute differences in response latency and infer the secret length. Attack preconditions include network access to the doveadm service and the capability to perform accurate timing measurements across multiple requests. The attacker learns only the length of the secret, not its value, but this information reduces the search space for brute-force attacks. Patches are available in versions 2.3.22.2, 3.0.7, and 3.1.6.
Affected products
- Open-Xchange Dovecot 2.3.0 through 2.3.22.1, 3.0.0 through 3.0.6, 3.1.0 through 3.1.5
Timeline
- 2026-08-28: disclosed
- 2026-08-28: patched: Patches available in versions 2.3.22.2, 3.0.7, and 3.1.6