Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 27, 2026 · NIST NVD

   Detected

   Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured credentials. Figuring out the credential will lead into full access to the affected component. Limit access to the doveadm http service port, install fixed version. No publicly available exploits are known.

2. Jul 15, 2026 · NIST NVD

   Updated

   Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured credentials. Figuring out the credential will lead into full access to the affected component. Limit access to the doveadm http service port, install fixed version. No publicly available exploits are known.

Affected

• cpe dovecot/dovecotversion unspecified
• cpe open-xchange/dovecotversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-27856

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-27856

  Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured credentials. Figuring out the credential will lead into full access to the affected component. Limit access to the doveadm h

  nvd.nist.gov

References

• Reference · access.redhat.com
• Reference · access.redhat.com
• Reference · bugzilla.redhat.com
• Vendor Advisory · documentation.open-xchange.com
• Reference · security.access.redhat.com