| Name | CVE-2026-33263 |
| Description | When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. If running in high-security mode (default for community releases), only the new submission connection gets terminated. If running in high-performance mode (default for Pro releases), all connections handled by the submission-login process will be terminated. The crashes can cause failure for user to send a message, or it can cause duplicate messages to be sent. If TLS is not used (in the backend server processing the submission), duplicate deliveries cannot happen, because the crash can only happen at AUTH stage. Limit the number of connections handled by single submission-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DSA-6526-1 |
| Debian Bugs | 1146018 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| dovecot (PTS) | bookworm, bookworm (security) | 1:2.3.19.1+dfsg1-2.1+deb12u6 | vulnerable |
| trixie | 1:2.4.1+dfsg1-6+deb13u6 | vulnerable | |
| trixie (security) | 1:2.4.1+dfsg1-6+deb13u7 | fixed | |
| forky | 1:2.4.5+dfsg1-2 | fixed | |
| sid | 1:2.4.5+dfsg1-3 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| dovecot | source | trixie | 1:2.4.1+dfsg1-6+deb13u7 | DSA-6526-1 | ||
| dovecot | source | (unstable) | 1:2.4.5+dfsg1-1 | 1146018 |
https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html#cve-2026-33263-submission-login-panic-when-mail-max-userip-connections-is-reached-panic-epoll-ctl-del-8-failed-bad-file-descriptor
Fixed by: https://github.com/dovecot/core/commit/ff8d8059d7ba85375c6dc723fc1b7743114fbba4
Fixed by: https://github.com/dovecot/core/commit/3e1959d6820207393c7059944333102d4897ef83
Fixed by: https://github.com/dovecot/core/commit/d4e13a3773db97a1ce6f4545d43c64ef0780672c
Fixed by: https://github.com/dovecot/core/commit/4d016e968857437ca1a6aa804c473e06079539f2
Fixed by: https://github.com/dovecot/core/commit/db0835c84bf754a260ce0d3dca1d69eb90f87518
Fixed by: https://github.com/dovecot/core/commit/a16f235aafb557eab10a653c4689d43e51fedcac
Fixed by: https://github.com/dovecot/core/commit/5fde53de4ebdf791a5fe583d4f8e52b89215bc7c
Fixed by: https://github.com/dovecot/pigeonhole/commit/33f5a95c0448e0d104f2cd7591e7f42c19b33199
Fixed by: https://github.com/dovecot/pigeonhole/commit/25e1e0adfa4ad44e3205fc8c62ca26a73cf6ee41