CVE-2026-33606: Dovecot dsync Protocol Injection Vulnerability

CVE-2026-33606 Overview

CVE-2026-33606 is a command injection vulnerability [CWE-93] affecting Dovecot's dsync synchronization tool when run with the stream protocol. A user can store mail content crafted to be interpreted as dsync protocol commands. When an administrator later runs dsync on that mailbox, for example during a migration or replication, the injected commands execute against the destination. Attackers can modify mailbox state and set internal mailbox attributes they should not control directly. The flaw can also trigger dsync errors that disrupt migrations. No publicly available exploits are known at time of publication.

Critical Impact
Unprivileged users can inject dsync protocol commands that manipulate mailbox state and internal attributes on the destination during migration or replication.

Affected Products

Open-Xchange Dovecot (versions prior to the fixed release referenced in advisory OXDC-ADV-2026-0003)
Dovecot deployments using dsync with the stream protocol
Environments performing dsync migrations or replication on mailboxes containing untrusted mail content

Discovery Timeline

2026-08-28 - CVE-2026-33606 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-33606

Vulnerability Analysis

Dovecot's dsync tool synchronizes mailbox state between two endpoints. When invoked with the stream protocol, dsync reads and writes protocol commands over a shared stream that also carries mail content. The parser does not sufficiently separate control commands from user-controlled mail data. An attacker who can deliver or store mail into a target mailbox can embed byte sequences that the receiving dsync process interprets as protocol commands. Successful injection lets the attacker set internal mailbox attributes the user cannot otherwise modify, alter destination state during synchronization, or force dsync to fail. The classification maps to CWE-93 (Improper Neutralization of CRLF Sequences).

Root Cause

The root cause is inadequate neutralization of protocol delimiters within mail content processed by the dsync stream protocol. Because mail bodies are trusted as opaque payload but travel over the same channel as control commands, boundary characters embedded in mail content are parsed as new command frames.

Attack Vector

Exploitation requires the attacker to deliver crafted content into a mailbox the administrator will later synchronize with dsync --stream. The attacker needs low privileges (an authenticated mailbox or the ability to send mail to one) and depends on a user action, the administrator running dsync. Impact is confined to integrity of mailbox state and availability of the migration operation. Confidentiality is not directly affected. See the Open-Xchange Security Advisory OXDC-ADV-2026-0003 for vendor technical details.

No verified exploit code is publicly available. The vulnerability
is triggered by mail content containing crafted byte sequences
that are re-interpreted as dsync protocol commands when parsed by
the receiving side of a stream-protocol dsync session.

Detection Methods for CVE-2026-33606

Indicators of Compromise

Unexpected dsync errors, aborted sessions, or protocol parse failures during migration or replication windows
Mailbox internal attributes changing on destination servers without a corresponding administrative action
Mail messages containing anomalous CR/LF sequences or byte patterns resembling dsync command framing in message bodies or headers
New or altered mailbox metadata appearing immediately after a dsync --stream run

Detection Strategies

Audit Dovecot logs for dsync sessions that terminate abnormally or report protocol-level errors
Compare source and destination mailbox attribute state after migrations to identify unexpected divergence
Scan stored mail content for embedded control sequences before running dsync against untrusted mailboxes

Monitoring Recommendations

Alert on dsync process invocations with the stream protocol against mailboxes that receive external mail
Forward Dovecot and dsync logs to a centralized log platform for correlation with mail delivery events
Track baseline mailbox attribute inventories and alert on drift following replication runs

How to Mitigate CVE-2026-33606

Immediate Actions Required

Update Dovecot to the non-vulnerable version identified in Open-Xchange advisory OXDC-ADV-2026-0003
Stop running dsync with the stream protocol against mailboxes containing untrusted user content until patched
Review recent migrations and replication events for signs of injected commands or attribute tampering
Restrict which operators can invoke dsync and require change-controlled migration windows

Patch Information

Open-Xchange has published fixes referenced in Open-Xchange Security Advisory OXDC-ADV-2026-0003. Administrators should apply the vendor-supplied update to Dovecot packages on all servers that perform dsync operations. Verify the fixed version in the advisory before scheduling migration activity.

Workarounds

Avoid dsync with the stream protocol on mailboxes that hold untrusted content until the update is applied
Use an alternative dsync transport (for example, TCP-based protocol) where operationally supported
Perform migrations from trusted staging copies rather than directly from user-writable mailboxes
Limit mail delivery to affected mailboxes during migration windows to reduce injection surface

bash

# Verify installed Dovecot version and confirm it matches
# the fixed release listed in OXDC-ADV-2026-0003 before running dsync
dovecot --version

# Prefer non-stream transport where supported, for example:
# dsync -u user@example.com backup tcp:destination-host