Open-Xchange Dovecot Pro/Dovecot CE IMAP Compression information disclosure

Summaryinfo

A vulnerability labeled as problematic has been found in Open-Xchange Dovecot Pro and Dovecot CE. Affected by this issue is some unknown functionality of the component IMAP Compression. The manipulation results in information disclosure. This vulnerability is reported as CVE-2026-40203. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Open-Xchange Dovecot Pro and Dovecot CE (the affected version unknown). It has been classified as problematic. Affected is an unknown part of the component IMAP Compression. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. CVE summarizes:

When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail and other mail in the same mailbox. An attacker that can send mail to a user and can also observe the sizes of that user's IMAP traffic can confirm whether the body of a small message matches a guessed text. Recovery of arbitrary unknown content was not demonstrated, but the attack can disclose whether a secret-like message body matches a candidate. Disable IMAP compression. Update to non-vulnerable version. No publicly available exploits are known.

The advisory is shared for download at documentation.open-xchange.com. This vulnerability is traded as CVE-2026-40203 since 04/10/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/28/2026). The MITRE ATT&CK project declares the attack technique as T1592.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-3076). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Open Source Dovecot

Productinfo

Type

• Mail Server Software

Vendor

• Open-Xchange

Name

• Dovecot CE
• Dovecot Pro

License

• open-source

Website

• Vendor: https://www.open-xchange.com/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion