CVE-2026-42395: 
Dovecot vulnerability analysis and mitigation

CVE-2026-42395 is a denial-of-service vulnerability in Open-Xchange Dovecot (both Community Edition and Pro) caused by improper handling of NUL bytes in forwarding information sent by trusted proxies. A host configured as a trusted proxy can send forwarding data containing a NUL byte, which crashes the login process on the subsequent login attempt, causing service degradation or denial of service for user logins. Affected versions include OX Dovecot Pro 2.3.0–2.3.22.2, 3.0.0–3.0.7, and 3.1.0–3.1.6, and OX Dovecot CE 2.3.0–2.4.5. Deployments that do not configure trusted proxies are not affected. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-170 (Improper Null Termination), reflecting the application's failure to properly validate or sanitize NUL bytes within proxy forwarding headers before processing them. An attacker positioned as a trusted proxy on an adjacent network can inject a NUL byte into forwarding information; when a subsequent login attempt is processed, the login process crashes due to improper null termination handling. Exploitation requires the attacker to already be configured as a trusted proxy, limiting the attack surface to adjacent-network actors with that specific trust relationship. No publicly available proof-of-concept exploit code is known (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in termination of the Dovecot login process, causing denial of service for user authentication — legitimate users are unable to log in to the mail server. The impact is limited to availability (low severity per CVSS), with no confidentiality or integrity compromise. There is no evidence of lateral movement potential or data exposure risk associated with this vulnerability, as the attack only affects the login process and does not grant the attacker access to mail data or system resources (GitHub Advisory).

No publicly available exploits or proof-of-concept code are known for CVE-2026-42395, and there is no evidence of in-the-wild exploitation. The EPSS score is approximately 0.181% (8th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable (GitHub Advisory).

Upgrade to a patched version: OX Dovecot Pro 2.3.22.2 or later, 3.0.7 or later, or 3.1.6 or later; OX Dovecot CE 2.4.5 or later. As an immediate workaround, restrict the list of trusted proxy networks exclusively to hosts that are fully under your control, minimizing the risk of a malicious or compromised proxy injecting NUL bytes. Deployments that do not configure any trusted proxies are not affected and require no action (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was disclosed by Open-Xchange GmbH via a CSAF advisory and reported to Red Hat's security response team, which opened a tracking bug (Bug 2525563) with medium priority and severity. The issue was also discussed on the oss-security mailing list and full-disclosure list shortly after publication. No significant researcher commentary or notable media coverage beyond standard vulnerability tracking has been observed, consistent with the moderate severity and limited exploitability of the flaw (Red Hat Bugzilla).