CVE-2026-42395: Trusted Proxy NUL Byte DOS Vulnerability

CVE-2026-42395 Overview

CVE-2026-42395 affects the Dovecot login process when trusted proxies are configured. A host listed as a trusted proxy can send forwarding information containing a NUL byte. That input crashes the login process on the following login attempt. The terminated process degrades service or denies logins for connecting users. Deployments that do not configure trusted proxies are not affected by this issue.

Open-Xchange published the issue in advisory OXDC-ADV-2026-0003. The vulnerability maps to [CWE-400] Uncontrolled Resource Consumption and requires network adjacency for exploitation. No public exploits are known at the time of publication.

Critical Impact
A trusted proxy peer can trigger a denial of service against the Dovecot login process, disrupting authentication for all users routed through the affected instance.

Affected Products

Dovecot (Open-Xchange distribution) deployments configured with trusted proxies
Instances that accept forwarding information from upstream proxy hosts
Environments where trusted_networks includes hosts not fully under administrator control

Discovery Timeline

2026-08-28 - CVE-2026-42395 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-42395

Vulnerability Analysis

The Dovecot login process accepts forwarding metadata from hosts listed as trusted proxies. When an upstream sends forwarding information that embeds a NUL byte, the login process fails to sanitize the input and terminates on the subsequent login attempt. The crash removes an active login worker, degrading throughput for authenticating clients.

The attack requires the sending host to already be listed in the trusted proxy configuration. That constraint restricts exploitation to peers on adjacent network segments or systems already granted proxy trust. Repeated triggering produces a sustained denial of service against mail login handling.

Root Cause

The root cause is improper handling of embedded NUL bytes within forwarding fields provided by trusted proxies. The login process treats the malformed input as fatal rather than rejecting the frame and continuing to service other connections. The behavior is classified under [CWE-400] because a single malformed message consumes and terminates a process serving many clients.

Attack Vector

Exploitation requires an adjacent network position and control over a host that the target Dovecot deployment already trusts as a proxy. No authentication or user interaction is required on the target. The attacker sends crafted forwarding data containing a NUL byte, then waits for the next login attempt to trigger the crash. Deployments without trusted proxy configuration are unaffected.

See the Open-Xchange Security Advisory OXDC-ADV-2026-0003 for the vendor's technical description.

Detection Methods for CVE-2026-42395

Indicators of Compromise

Unexpected termination or restart events for the Dovecot login process in system logs
Login failures or session drops correlated with traffic from trusted proxy hosts
Forwarding fields in proxy protocol frames containing embedded NUL (\\x00) bytes

Detection Strategies

Monitor Dovecot process supervisor logs for repeated crash and respawn cycles of the login worker
Inspect traffic from trusted proxy sources for malformed forwarding headers containing NUL bytes
Correlate authentication service outages with connection events from hosts in trusted_networks

Monitoring Recommendations

Alert on abnormal restart frequency for Dovecot login processes over short intervals
Track authentication failure rate baselines and alert on deviations tied to specific upstream peers
Log and review any configuration changes that add hosts to the trusted proxy list

How to Mitigate CVE-2026-42395

Immediate Actions Required

Update Dovecot to the non-vulnerable version identified in Open-Xchange advisory OXDC-ADV-2026-0003
Audit trusted_networks and remove any host not fully under administrative control
Restrict network paths so only vetted proxies can reach the Dovecot login service

Patch Information

Open-Xchange has released a fixed version of Dovecot addressing the NUL byte handling defect. Administrators should apply the vendor patch referenced in advisory OXDC-ADV-2026-0003 and restart the Dovecot service to load the corrected login process binary.

Workarounds

Remove trusted proxy configuration entirely if upstream proxies are not required
Constrain trusted_networks to CIDR ranges containing only hardened, administrator-controlled hosts
Place network filters between untrusted segments and the Dovecot login listener

bash

# Example: restrict Dovecot trusted_networks to controlled hosts only
# /etc/dovecot/conf.d/10-master.conf
login_trusted_networks = 10.0.10.5 10.0.10.6

# Reload configuration after applying the vendor patch
doveadm reload
systemctl restart dovecot