CVE-2026-40203: IMAP Compression Information Disclosure

CVE-2026-40203 Overview

CVE-2026-40203 is an information disclosure vulnerability in Dovecot IMAP servers where enabling IMAP compression allows a network-adjacent attacker to confirm the contents of a small message body. When IMAP compression is enabled, the same compression state is reused across responses in a session. Response sizes then depend on both attacker-supplied mail and other mail in the same mailbox. An attacker who can deliver mail to a target and observe the sizes of that user's IMAP traffic can confirm whether a small message body matches a guessed text. The issue is tracked as an information exposure weakness [CWE-200] and was disclosed in Open-Xchange Security Advisory 2026-0003.

Critical Impact
Confirmation of secret-like message content through a compression side channel when an attacker can both send mail to the victim and observe IMAP traffic sizes.

Affected Products

Dovecot IMAP server deployments with IMAP compression enabled
Open-Xchange Dovecot distributions referenced in advisory oxdc-adv-2026-0003
IMAP sessions where compression state is shared across responses

Discovery Timeline

2026-08-28 - CVE-2026-40203 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-40203

Vulnerability Analysis

The flaw is a compression-based side channel similar in class to CRIME and BREACH attacks against TLS. Dovecot's IMAP compression extension reuses a single compression context across responses within a session. Compressed response length therefore reflects redundancy between attacker-controlled input and other data in the same mailbox.

An attacker who can deliver mail to the victim can inject candidate plaintext into the same compression window that later processes a target message. If the candidate matches the target, the compressor emits shorter output. By observing IMAP traffic sizes on the network, the attacker learns whether the guess matched.

Recovery of arbitrary unknown content was not demonstrated. The confirmed impact is oracle-style confirmation of whether a small, secret-like message body matches an attacker's candidate. The EPSS score is 0.219% (percentile 12.234), and no public exploit is available.

Root Cause

The root cause is shared compression state across IMAP responses within a session. Compressing distinct responses under a single dictionary lets redundancy between attacker input and victim data leak through observable ciphertext length, an information exposure pattern classified under [CWE-200].

Attack Vector

Exploitation requires two capabilities. First, the attacker must send mail into the victim's mailbox to inject candidate strings. Second, the attacker must observe the victim's IMAP network traffic to measure response sizes. High attack complexity reflects the need for both mail injection and passive traffic observation of the same session. See the Open-Xchange Security Advisory 2026-0003 for vendor-supplied technical details.

Detection Methods for CVE-2026-40203

Indicators of Compromise

IMAP sessions negotiating the COMPRESS=DEFLATE extension from unexpected clients or networks
Repeated inbound mail from a single sender containing large, structured, or high-entropy bodies targeting one recipient
Passive capture or mirroring of IMAP traffic near the mail server or client segment

Detection Strategies

Inventory Dovecot configurations for the imap_compress plugin and enumerate sessions that enable compression
Correlate inbound SMTP delivery patterns with subsequent IMAP compression sessions for the same mailbox
Alert on network capture tools or unauthorized packet mirroring adjacent to IMAP servers or user segments

Monitoring Recommendations

Log IMAP capability negotiation and flag sessions that activate compression
Monitor for anomalous volumes of inbound mail followed by IMAP reads of the affected mailbox
Track network taps, SPAN ports, and TLS-terminating middleboxes that could expose IMAP response sizes

How to Mitigate CVE-2026-40203

Immediate Actions Required

Disable IMAP compression on Dovecot servers until a patched build is deployed
Update Dovecot to a non-vulnerable version as referenced in Open-Xchange advisory oxdc-adv-2026-0003
Restrict who can deliver mail to sensitive mailboxes and enforce sender authentication

Patch Information

Open-Xchange has published fixed versions and configuration guidance in Open-Xchange Security Advisory 2026-0003. Administrators should apply the vendor-supplied update and validate that compression is either patched or disabled after upgrade.

Workarounds

Set imap_compress to disabled in dovecot.conf and reload the service
Terminate IMAP connections over TLS and prevent packet capture on paths between clients and servers
Segment mail infrastructure to limit passive observation of client-to-server IMAP traffic

bash

# Configuration example: disable IMAP compression in Dovecot
# /etc/dovecot/conf.d/20-imap.conf
protocol imap {
  # Remove imap_zlib from mail_plugins to disable COMPRESS=DEFLATE
  mail_plugins = $mail_plugins
}

# Verify the capability is no longer advertised
# openssl s_client -connect mail.example.com:993 -quiet
# a1 CAPABILITY