CVE-2026-33263
Description
A flaw was found in the Dovecot mail server's submission-login component. This vulnerability occurs when the server reaches its maximum allowed user IP connections, leading to a crash due to file descriptor handling issues. This can result in a denial of service, preventing users from sending emails, and potentially causing duplicate message delivery under certain conditions.
Mitigation
To mitigate this issue, limit the number of connections handled by a single submission-login process. This can be achieved by adjusting the `process_limit` setting for the `submission-login` service in the Dovecot configuration. For example, add or modify the following in a Dovecot configuration file (e.g., `/etc/dovecot/conf.d/10-master.conf`):
service submission-login {
process_limit = <lower_value>
}
Reducing this limit may impact performance. After modifying the configuration, restart the Dovecot service for the changes to take effect.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.1 | N/A | 4.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | Low | N/A | None |
| Availability Impact | High | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Files or Directories
The program could read data from the wrong file.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Accessing a file descriptor that has been closed can cause a crash.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
