CVE-2026-33604 in Dovecot Pro
Summary
by MITRE • 08/28/2026
An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that hasn't yet fixed the SMTP smuggling vulnerability can be tricked into treating part of the message body as new SMTP commands, allowing injection of spoofed email. This is the same vulnerability class as CVE-2023-51764 and CVE-2023-51766. Where you control the receiving mail servers, ensure they reject bare carriage returns in message data. Update to non-vulnerable version. No publicly available exploits are known.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability described constitutes a sophisticated SMTP smuggling attack vector within the Dovecot Mail Server software, specifically affecting systems configured for Sieve redirect or submission relay operations. This flaw allows an attacker who has gained the ability to submit messages through these specific pathways to manipulate message formatting in order to bypass outbound content protection mechanisms. The core technical issue lies in how certain downstream mail servers interpret line endings within email bodies. By crafting a message body that includes specific, potentially bare carriage return characters or other ambiguous line termination sequences, an attacker can cause the receiving server to misinterpret part of the payload as new SMTP commands rather than mere data content. This behavior mirrors the mechanics observed in CVE-2023-51764 and CVE-2023-51766, which are also classified under the broader category of HTTP/SMTP smuggling vulnerabilities where protocol boundaries are blurred to inject malicious instructions into a stream that should be treated as opaque data.
From an operational impact perspective, this vulnerability enables email injection attacks that can lead to significant security breaches including spoofed emails and potential phishing campaigns. When a downstream mail server processes these smuggled commands, it may execute actions such as delivering messages to unintended recipients or altering message headers in ways that compromise the integrity of communication channels. This is particularly dangerous because it exploits trust relationships between mail servers and relies on inconsistencies in how different implementations handle SMTP protocol boundaries. The ability to inject spoofed email undermines authentication mechanisms like SPF and DKIM, potentially allowing attackers to impersonate legitimate entities with high credibility since the message appears to originate from a trusted relay point within the infrastructure.
The technical classification of this vulnerability aligns closely with CWE-94 Improper Control of Generation of Code or Commands, specifically in contexts where user input influences command structure without adequate sanitization. It also maps to MITRE ATT&CK techniques related to Email Delivery and Command Line Interface abuse, as it involves manipulating protocol-level commands through data fields. The root cause typically stems from insufficient validation of line endings during the parsing phase, allowing characters that signal new SMTP transactions to be embedded within message bodies where they should remain inert. This is a classic example of boundary confusion in stateful protocols like SMTP, which relies on clear delimiters between command headers and body content.
Mitigation strategies must address both immediate configuration adjustments and long-term software updates. Organizations controlling receiving mail servers should implement strict filtering rules to reject messages containing bare carriage returns or other ambiguous line terminators within the message data section. This proactive measure prevents the downstream server from misinterpreting these characters as command delimiters, effectively neutralizing the smuggling vector regardless of whether the upstream Dovecot instance is patched. Additionally, updating Dovecot to a version that resolves this specific flaw is critical for preventing exploitation at the source. Security teams should also review their SMTP relay configurations and ensure that outbound protections are robust enough to detect and block anomalous line ending patterns before they reach external recipients. Since no public exploits are currently known, immediate patching may be prioritized based on risk assessment, but defensive filtering remains essential given the potential for future exploit development by threat actors familiar with this vulnerability class.