CVE-2026-33603

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to position itself between Dovecot and the client connection. If successful, the attacker can eavesdrop communications between Dovecot and client as MITM proxy. Install fixed version. No publicly available exploits are known.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-99

Affected software

No affected versions have been published.

Timeline

Published: May 12, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-336045.9An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending i CVE-2026-336057.5An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running i CVE-2026-336064.8Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync wit CVE-2026-336074.3An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. M CVE-2026-336089.8An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update CVE-2026-336096.5Incomplete escaping of LDAP queries when running with 8bit-dns enabled allows users to perform queries of internal domain subtrees.CVE-2026-33616.4The WP Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpsl_address' post meta value in versions up CVE-2026-336107.5A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondary server forwards a CVE-2026-336114.9An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn c CVE-2026-336127.5A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to cache poisoning.CVE-2026-336138.8Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulnerability in the gene CVE-2026-336147.5An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo endpoint due to improper neutra