CVE-2026-33604: Medium severity Dovecot vulnerability
An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that hasn't yet fixed the SMTP smuggling vulnerability can be tricked into treating part of the message body as new SMTP commands, allowing injection of spoofed email. This is the same vulnerability class as CVE-2023-51764 and CVE-2023-51766. Where you control the receiving mail servers, ensure they reject bare carriage returns in message data. Update to non-vulnerable version. No publicly available exploits are known.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must be able to cause Dovecot to relay a message, such as through Sieve redirect or submission relay, and must craft a message body containing the relevant line ending. Successful command injection also depends on the downstream receiving mail server remaining vulnerable to SMTP smuggling.
Which systems are most exposed?
Deployments using Dovecot for outbound relaying are exposed when relayed mail can reach downstream mail servers that do not reject bare carriage returns in message data. The practical impact is spoofed-email injection at those downstream servers.
What can be done before Dovecot is updated?
Where the receiving mail servers are under your control, configure them to reject bare carriage returns in message data. This limits the downstream SMTP-smuggling condition needed for the attack.
Are public exploits available?
No publicly available exploits are known.