CVE-2026-27856

MediumCVSS 5.9/10Last modified Oct 26, 2026

Description

Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured credentials. Figuring out the credential will lead into full access to the affected component. Limit access to the doveadm http service port, install fixed version. No publicly available exploits are known.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-287 CWE-208

Affected software

Vendor	Product	Versions
Open-Xchange GmbH	OX Dovecot Pro	<= 2.3.0
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	—
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—

References

Timeline

Published: Mar 27, 2026
Last modified: Oct 26, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-278577.5Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client CVE-2026-278587.5Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacke CVE-2026-278595.3A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU. A suitably formatted mail message ca CVE-2026-27869.8Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thun CVE-2026-278605.3If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially CVE-2026-278674.8An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action is required) who h CVE-2026-278686.9An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) wh CVE-2026-278696.9An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) wh CVE-2026-27879.8Use-after-free in the DOM: Window and Location component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8 CVE-2026-278704.8An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action IS required) who h CVE-2026-278712.9Cwe-327 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Johnson Controls TL280 allows Cryptanalytic Attack. This issue af CVE-2026-278725.6- Improper Privilege Management vulnerability in Johnson Controls Easy IO FG allows (Brute Force). This issue affects Easy IO FG: before 2.