1. Home
  2. CVE Database
  3. CVE-2026-33603
MEDIUM · 6.8

CVE-2026-33603

Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to position itself between Dovecot and the cl...

Vulnerability Description

Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to position itself between Dovecot and the client connection. If successful, the attacker can eavesdrop communications between Dovecot and client as MITM proxy. Install fixed version. No publicly available exploits are known.

CVSS Score

6.8

MEDIUM

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
ADJACENT_NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
DovecotDovecot< 2.4.4
Open-XchangeDovecot< 3.1.5

Related Weaknesses (CWE)

CWE-99

References

FAQ

What is CVE-2026-33603?

CVE-2026-33603 is a vulnerability with a CVSS score of 6.8 (MEDIUM). Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to position itself between Dovecot and the cl...

How severe is CVE-2026-33603?

CVE-2026-33603 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-33603?

Check the references section above for vendor advisories and patch information. Affected products include: Dovecot Dovecot, Open-Xchange Dovecot.