Medium severity · published Aug 28, 2026
CVE-2026-33263
When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues
4.3
CVSS
0.6%
EPSS
No
On KEV
Description
When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. If running in high-security mode (default for community releases), only the new submission connection gets terminated. If running in high-performance mode (default for Pro releases), all connections handled by the submission-login process will be terminated. The crashes can cause failure for user to send a message, or it can cause duplicate messages to be sent. If TLS is not used (in the backend server processing the submission), duplicate deliveries cannot happen, because the crash can only happen at AUTH stage. Limit the number of connections handled by single submission-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OD
OX Dovecot CE · Open-Xchange GmbH
2.3.0 before 2.4.5 · source: vendor
OD
OX Dovecot Pro · Open-Xchange GmbH
2.3.0 before 2.3.22.2; 3.0.0 before 3.0.7; 3.1.0 before 3.1.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33263
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33263
documentation.open-xchange.com
https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json
More from OX Dovecot CE
9.1
CVE-2026-42007
An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents…
7.5
CVE-2026-42391
An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately
7.5
CVE-2026-33605
An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating
7.5
CVE-2026-27852
An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage…
7.4
CVE-2026-73208
An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used…