CVE-2026-33263: Submission-Login DOS Vulnerability

CVE-2026-33263 Overview

CVE-2026-33263 affects the Dovecot submission-login process when the mail_max_userip_connections limit (default 10) is reached. The service can crash with an epoll() panic caused by improper file descriptor handling [CWE-403]. In high-security mode, the default for community releases, only the new submission connection terminates. In high-performance mode, the default for Pro releases, every connection handled by the affected submission-login process is terminated. The crash triggers at the AUTH stage and can prevent message delivery or, when TLS is used with the backend, cause duplicate messages to be sent.

Critical Impact
Authenticated remote attackers can crash submission-login processes, causing message delivery failures or duplicate deliveries when TLS is used with the backend server.

Affected Products

Open-Xchange Dovecot submission-login (community releases running in high-security mode)
Open-Xchange Dovecot Pro submission-login (running in high-performance mode)
Deployments where mail_max_userip_connections is set to any value (default 10)

Discovery Timeline

2026-08-28 - CVE-2026-33263 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-33263

Vulnerability Analysis

The vulnerability sits in the submission-login service that handles SMTP submission authentication. When a user reaches the connection limit defined by mail_max_userip_connections, the process mishandles file descriptors during connection rejection. The epoll() event loop then panics on an invalid descriptor and the process aborts.

The blast radius depends on the running mode. High-security mode isolates each connection in its own process, so only the offending new connection dies. High-performance mode multiplexes many client connections through a single submission-login process, so a single panic terminates every active submission session in that process.

When TLS is negotiated with the backend server, a crash mid-transaction can leave the backend uncertain about delivery state. The client may retry, causing duplicate deliveries. Without TLS to the backend, the crash occurs only at the AUTH stage before message content is transferred, so duplicate deliveries cannot happen.

Root Cause

The underlying weakness is a file descriptor lifecycle bug classified under [CWE-403] (Exposure of File Descriptor to Unintended Control Sphere). Descriptors registered with epoll() are not consistently cleaned up when the userip connection cap rejects a new session, leading to inconsistent state in the event loop.

Attack Vector

An authenticated user with valid submission credentials repeatedly opens submission connections from the same IP until mail_max_userip_connections is exceeded. Reaching that threshold triggers the descriptor handling defect and crashes the submission-login worker. See the Open-Xchange Security Advisory OXDC-ADV-2026-0003 for vendor details.

No publicly available exploits are known.

Detection Methods for CVE-2026-33263

Indicators of Compromise

Dovecot log entries containing epoll panic messages tied to the submission-login process.
Repeated Maximum number of connections from user+IP exceeded warnings for mail_max_userip_connections immediately preceding a crash.
Unexpected termination of the submission-login process followed by master supervisor restart events.
Increased user reports of failed sends or duplicate messages on the submission service.

Detection Strategies

Correlate submission-login crash events with recent bursts of AUTH attempts from the same authenticated user and source IP.
Alert when a single account exceeds the configured mail_max_userip_connections threshold within short windows.
Monitor submission-login process restart frequency and treat sustained restarts as a service-availability incident.

Monitoring Recommendations

Ingest Dovecot logs into a centralized log platform and build detections on panic strings and connection-limit warnings.
Track duplicate message delivery rates on downstream MTAs to catch retry-driven duplication caused by mid-AUTH crashes.
Baseline normal submission connection counts per user and IP, and alert on sudden spikes.

How to Mitigate CVE-2026-33263

Immediate Actions Required

Update Dovecot to the non-vulnerable version identified in the vendor advisory as soon as maintenance windows allow.
Audit mail_max_userip_connections settings across all submission-login deployments and identify hosts running in high-performance mode.
Enable log-based alerting for submission-login panics until patching is complete.

Patch Information

Open-Xchange has released fixed versions referenced in Open-Xchange Security Advisory OXDC-ADV-2026-0003. Apply the vendor-supplied update to remove the vulnerable file descriptor handling in submission-login.

Workarounds

Reduce the number of connections handled by a single submission-login process to shrink the blast radius, accepting a performance penalty.
Consider running submission-login in high-security mode where feasible, so a crash affects only the offending connection.
Rate-limit submission clients upstream to prevent authenticated users from repeatedly hitting the mail_max_userip_connections cap.

bash

# Configuration example: cap connections per submission-login process
# in /etc/dovecot/conf.d/10-master.conf
service submission-login {
  # Lower client_limit reduces the number of sessions a single
  # process handles, limiting impact if it crashes.
  client_limit = 50
  process_limit = 200
}

# Optionally tighten per-user+IP connection cap in /etc/dovecot/dovecot.conf
mail_max_userip_connections = 5