CVE-2026-33604: Dovecot SMTP Smuggling Auth Bypass Flaw

CVE-2026-33604 is an authentication bypass vulnerability in Dovecot that enables SMTP smuggling attacks through crafted line endings. Attackers can inject spoofed emails by bypassing outbound protections. This article covers technical details, impact assessment, affected versions, and recommended mitigation strategies.

CVE-2026-33604 Overview

CVE-2026-33604 is an SMTP smuggling vulnerability in Dovecot's outbound message relay. An attacker who can induce Dovecot to relay a message, for example through Sieve redirect or submission relay, can embed a crafted line ending in the message body. This bypasses the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that has not remediated the SMTP smuggling class of flaws can then treat part of the body as new SMTP commands, enabling spoofed email injection. This is the same vulnerability class as CVE-2023-51764 and CVE-2023-51766, tracked under [CWE-655] Insufficient Compartmentalization.

Critical Impact
Attackers can inject spoofed email through downstream SMTP relays, undermining sender authentication and enabling phishing at scale.

Affected Products

Dovecot mail server (versions prior to the fixed release referenced in the Open-Xchange advisory)
Deployments using Sieve redirect functionality
Deployments using Dovecot submission relay

Discovery Timeline

2026-08-28 - CVE-2026-33604 published to the National Vulnerability Database (NVD)
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-33604

Vulnerability Analysis

SMTP smuggling exploits inconsistencies in how mail servers interpret line terminators in the Data phase of the Simple Mail Transfer Protocol (SMTP). The protocol defines <CR><LF>.<CR><LF> as the end-of-data sequence. When one server accepts bare <LF> or bare <CR> as line terminators and a downstream server treats different sequences as valid terminators, an attacker can smuggle SMTP commands past the sending server. The receiving server then processes those commands as a new message envelope, allowing arbitrary MAIL FROM and RCPT TO values.

Dovecot previously added outbound protection to canonicalize line endings and prevent this smuggling on relayed messages. CVE-2026-33604 identifies a bypass in that protection. A specifically crafted line ending in the message body escapes normalization, preserving the smuggled command sequence when Dovecot hands the message off to the next hop.

Root Cause

The root cause is incomplete sanitization of line terminators in Dovecot's message relay path. The outbound filter fails to normalize a specific line-ending pattern before forwarding message data to the next SMTP hop, leaving the smuggling primitive intact.

Attack Vector

Exploitation requires the attacker to submit a message that Dovecot will relay. Sieve redirect rules and authenticated submission relay are the primary paths. The attacker embeds a crafted terminator inside the message body followed by forged SMTP verbs. When Dovecot forwards the message to a downstream Mail Transfer Agent (MTA) that still accepts bare carriage returns, the downstream MTA parses the injected commands as a new SMTP transaction and delivers a spoofed message. No verified proof-of-concept code has been published. See the Open-Xchange Security Advisory OXDC-ADV-2026-0003 for vendor technical detail.

Detection Methods for CVE-2026-33604

Indicators of Compromise

Outbound messages from Dovecot containing bare <CR> or bare <LF> sequences inside the DATA payload
Downstream MTA logs showing unexpected MAIL FROM or RCPT TO transactions immediately after a relayed message
Sieve redirect activity from accounts with no prior redirect history
Bounce messages or DMARC failure reports referencing spoofed senders that appear to originate from your infrastructure

Detection Strategies

Inspect SMTP DATA streams at egress for non-canonical line terminators before hand-off to downstream relays
Correlate Dovecot submission and Sieve redirect logs with downstream MTA envelope logs to identify command injection
Alert on DMARC, SPF, or DKIM failures for outbound mail flows that traverse Dovecot relays

Monitoring Recommendations

Enable verbose SMTP protocol logging on both Dovecot and the next-hop MTA and retain for correlation
Monitor volume anomalies on Sieve redirect and submission relay counters
Track authentication logs for accounts whose Sieve scripts have been recently modified

How to Mitigate CVE-2026-33604

Immediate Actions Required

Upgrade Dovecot to the fixed version referenced in the Open-Xchange advisory
Configure downstream MTAs under your control to reject bare carriage returns and bare line feeds in SMTP DATA
Audit Sieve scripts for unauthorized redirect actions and restrict Sieve capabilities where not required
Review submission relay authorization policies and disable relay for accounts that do not need it

Patch Information

Open-Xchange has published a fixed Dovecot release in advisory OXDC-ADV-2026-0003. Operators should apply the vendor-supplied packages and restart the dovecot service. No publicly available exploits are known at this time, and the EPSS score stands at 0.269%.

Workarounds

Where receiving MTAs are under your control, configure them to reject bare <CR> in message data
Disable Sieve redirect for untrusted users until the patch is applied
Restrict submission relay to authenticated users on trusted networks

bash

# Postfix example: reject bare newlines in received SMTP data
# /etc/postfix/main.cf
smtpd_forbid_bare_newline = yes
smtpd_forbid_bare_newline_exclusions = $mynetworks