CVE-2026-42393

Deferred Deferred - Pending Action

Timing Side Channel in Dovecot doveadm Service

Publication date: 2026-08-28

Last updated on: 2026-09-03

Assigner: Open-Xchange

Description

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of the secret, which reduces the effort needed to guess it. The secret value itself is not disclosed. Restrict network access to the doveadm service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-03

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-42393

EUVD

EUVD-2026-67676

Affected Vendors & Products

Vendor	Product	Version / Range
open-xchange	doveadm	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability involves a timing side-channel in the comparison of doveadm passwords and API keys. The comparison is not fully timing safe, meaning an attacker can measure response times to determine the length of the secret, though not the secret itself. This reduces the effort needed for brute-force guessing.

Detection Guidance

This vulnerability requires network access to the doveadm service and the ability to measure response timing accurately. Use network monitoring tools like tcpdump or Wireshark to capture traffic to the doveadm service. Analyze response times for repeated requests to detect timing variations that may indicate the vulnerability.

Impact Analysis

If an attacker gains network access to the doveadm service, they can repeatedly send requests and measure response times to infer the length of the secret. This weakens security by making it easier to guess the secret through brute-force attacks.

Compliance Impact

This vulnerability does not directly disclose secret values but reveals their length through timing attacks. While not a direct compliance violation, it could weaken authentication security, potentially impacting GDPR (data protection) or HIPAA (health data security) if exploited to gain unauthorized access.

Mitigation Strategies

Restrict network access to the doveadm service to only trusted clients. Update to a non-vulnerable version of the software as soon as possible. Ensure the service is not exposed to untrusted networks or systems.

Hi! I’m here to help you understand CVE-2026-42393. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70