CVE-2026-42395

State: Published
Severity: 4.3 Medium
Published: Aug 28, 2026
Updated: Aug 28, 2026
Reserved: Apr 27, 2026

Description

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	OX

Weaknesses

CWE-400 Uncontrolled Resource Consumption

Affected Products

Product	Versions
OX Dovecot ProOpen-Xchange GmbH	2.3.0 to before 2.3.22.2Affected 3.0.0 to before 3.0.7Affected 3.1.0 to before 3.1.6Affected
OX Dovecot CEOpen-Xchange GmbH	2.3.0 to before 2.4.5Affected

References

https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.jsonvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.