CVE-2026-33603

{
  "id": "CVE-2026-33603",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-12T14:17:01.600",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to position itself between Dovecot and the client connection. If successful, the attacker can eavesdrop communications between Dovecot and client as MITM proxy. Install fixed version. No publicly available exploits are known."
    },
    {
      "lang": "es",
      "value": "El atacante puede usar un intercambio base64 especialmente diseñado entre Dovecot y el cliente para falsificar la vinculación de canal TLS de SCRAM. Esto requiere que el atacante pueda posicionarse entre Dovecot y la conexión del cliente. Si tiene éxito, el atacante puede interceptar las comunicaciones entre Dovecot y el cliente como proxy MitM. Instale la versión corregida. No se conocen exploits disponibles públicamente."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Open-Xchange GmbH",
          "product": "OX Dovecot Pro",
          "defaultStatus": "unaffected",
          "modules": [
            "core"
          ],
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "3.1.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThanOrEqual": "2.4.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.2
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-12T15:07:52.503674Z",
          "id": "CVE-2026-33603",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-99"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.4.4",
              "matchCriteriaId": "86CE1F3B-DF73-431A-9EC0-491E8969A187"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:open-xchange:dovecot:*:*:*:*:pro:*:*:*",
              "versionEndExcluding": "3.1.5",
              "matchCriteriaId": "28C2DD58-A4B0-4F2C-BC60-F30F380251BC"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}