CVE-2026-33263

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1

Description A crash can occur in the submission-login process when the mail max userip connections limit is reached, resulting in an epoll() panic due to file descriptor handling issues. In high-security mode, only the new submission connection is terminated. In high-performance mode, all connections managed by the submission-login process are terminated. This may lead to failures in sending messages or the delivery of duplicate messages. If TLS is not used in the backend server processing the submission, duplicate deliveries are prevented as the crash only occurs during the AUTH stage.

Recommendations Update to version 2.4.5-1.1. Limit the number of connections handled by a single submission-login process to mitigate the risk, although this may impact performance.