Loading story…
Open-Xchange disclosed Dovecot Security Advisory OXDC-2026-0001, detailing 12 confirmed vulnerabilities in OX Dovecot CE and Pro that affect core authentication, login, ManageSieve, LMTP, and indexing-related functionality. The issues span authentication bypass, SQL injection, LDAP injection, path traversal, information disclosure, replay and timing attacks, and multiple denial-of-service conditions tied to invalid input, memory exhaustion, CPU exhaustion, and service crashes. One of the most serious flaws, CVE-2026-24031, can enable authentication bypass through SQL injection when auth_username_chars is cleared.
The advisory says the most severe impacts include arbitrary-user authentication bypass, repeated crashes in ManageSieve or login services, unintended indexing of local files, and possible credential recovery against doveadm HTTP under timing-oracle conditions. Several bugs were described as regressions introduced in Dovecot 2.4 or later. Open-Xchange said most issues were fixed in OX Dovecot CE 2.4.3 and OX Dovecot Pro 3.1.4, with some fixes also available in Pro 3.0.5, Pro 2.3.22.1, CE 2.4.1, and CE 2.4.0; it added that no public exploits are known and urged users to upgrade, restrict exposed services, disable vulnerable features, and avoid unsafe configuration choices.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The advisory states that most vulnerabilities were fixed in OX Dovecot CE 2.4.3 and OX Dovecot Pro 3.1.4, with some fixes also available in Pro 3.0.5 and Pro 2.3.22.1. It also notes earlier fixes for specific issues in CE 2.4.1 and 2.4.0.
On 2026-03-27, Open-Xchange disclosed Security Advisory OXDC-2026-0001 covering 12 confirmed vulnerabilities in OX Dovecot CE and Pro. The issues affected authentication, login, ManageSieve, LMTP, and indexing-related functionality, including authentication bypass, injection flaws, path traversal, information disclosure, replay and timing attacks, and multiple denial-of-service conditions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Roundcube Webmail released urgent security updates to fix multiple high-risk vulnerabilities across supported branches, including versions **1.6.16** and **1.7.1**, following earlier fixes in **1.6.14** for the 1.6.x line. The newly disclosed issues include **CVE-2026-48842**, a pre-authentication SQL injection flaw in the `virtuser_query` plugin with a CVSS score of **8.1**, and **CVE-2026-48844**, a code injection bug tied to direct code evaluation in LDAP autovalues configuration that could enable arbitrary command execution. Additional patches address XSS, session poisoning, arbitrary file deletion, and SSRF bypass vulnerabilities tracked as **CVE-2026-48845** through **CVE-2026-48849**, and a dCERT advisory also lists Roundcube as affected by multiple vulnerabilities. Earlier Roundcube fixes had already addressed a separate set of severe weaknesses, including a pre-authentication arbitrary file write issue in Redis and Memcached session handlers that could lead to unauthenticated remote code execution and full server compromise, along with account takeover, SSRF, IMAP injection, CSRF bypass, and HTML attachment preview XSS. Researchers credited across the disclosures include **y0us**, **Georgios Tsimpidas**, **flydragon777**, the **Martila Security Research Team**, **aikido_security**, and **nullcathedral**. Roundcube described the releases as stable and urged administrators to back up systems and deploy updates quickly to protect exposed email infrastructure from pre-authentication exploitation.
Jun 29, 2026
Spring disclosed a broad set of vulnerabilities across **Spring Framework**, **Spring Data Commons**, and **Spring LDAP**, including a high-severity authentication bypass tracked as `CVE-2026-41720`. The LDAP flaw allows login with a valid username and an empty or null password when the backing LDAP server permits unauthenticated binds, affecting authentication flows that use `AbstractContextSource`, `LdapTemplate`, or `LdapClient`. Spring also fixed a low-severity WebFlux session fixation issue (`CVE-2026-41839`) tied to compromised subdomains, and an information disclosure bug (`CVE-2026-41841`) in Spring MVC and WebFlux where shared static-resource caches could expose protected files if a public resource with the same name had already been cached. Several denial-of-service issues were patched at the same time. In Spring Framework, `CVE-2026-41840` can leak memory through malicious multipart requests in WebFlux, while `CVE-2026-41842` can tie up HTTP connections through slow resolution of versioned file-system resources in Spring MVC or WebFlux. In Spring Data Commons, `CVE-2026-41695`, `CVE-2026-41711`, `CVE-2026-41716`, and `CVE-2026-41721` can be triggered by attacker-controlled property paths, sort parameters, property names, or `@ProjectedPayload` data binding, leading to stack overflows, heap exhaustion, or excessive memory allocation when applications expose those inputs to untrusted users. Spring urged customers to upgrade to fixed releases, including Framework `7.0.8`, `6.2.19`, and `6.1.28`, Data Commons `4.0.6` and `3.5.12`, and LDAP `2.4.5`, `3.2.18`, `3.3.8`, or `4.0.4`, with some older branches receiving fixes only through commercial support.
Jun 29, 2026
**OpenSSL released a security update on January 27, 2026**, addressing **12 vulnerabilities** across supported branches, including **one High-severity issue with potential remote code execution (RCE)**, one Moderate, and multiple Low-severity flaws. The most serious vulnerability, **CVE-2025-15467 (High)**, is a **pre-authentication stack buffer overflow** in **CMS `AuthEnvelopedData` parsing** when using AEAD ciphers (e.g., **AES-GCM**); a crafted CMS message with an **oversized IV in ASN.1 parameters** can trigger a crash and may enable code execution in applications that parse **untrusted CMS/PKCS#7 content** (notably **S/MIME** workflows). Both sources emphasize that while **DoS is the most likely outcome in many environments**, the presence of a stack write primitive makes the issue operationally significant where untrusted CMS is processed. A second notable issue, **CVE-2025-11187 (Moderate)**, involves a **stack overflow during PKCS#12 MAC verification** (PBMAC1/PBKDF2-related validation), where attacker-controlled parameters (e.g., key length) can lead to crashes and potentially more severe impact when processing **untrusted PKCS#12 files** (e.g., certificate import/export, PKI/CA tooling). Affected versions called out include **OpenSSL 3.x** (with additional low-severity issues spanning older branches such as **1.0.2 and 1.1.1**), and patched releases include **3.6.1, 3.5.5, 3.4.4, 3.3.6, and 3.0.19** (with corresponding fixes for older maintained lines). Datadog notes **OpenSSL 3.x FIPS modules are not affected** by the highlighted CMS and PKCS#12 overflow issues, and both sources point to higher risk in services that ingest these formats from external or user-supplied inputs (e.g., S/MIME gateways, certificate management services).
Jun 29, 2026