Description

An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that hasn't yet fixed the SMTP smuggling vulnerability can be tricked into treating part of the message body as new SMTP commands, allowing injection of spoofed email. This is the same vulnerability class as CVE-2023-51764 and CVE-2023-51766. Where you control the receiving mail servers, ensure they reject bare carriage returns in message data. Update to non-vulnerable version. No publicly available exploits are known.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-28T12:16:27.613Z",
  "pubdate": "2026-08-28T12:16:27.613Z",
  "executiveSummary": "This vulnerability is an SMTP smuggling flaw affecting Dovecot, allowing an attacker to inject arbitrary SMTP commands into outbound email streams. The vulnerability occurs when Dovecot fails to correctly sanitize message bodies that contain crafted line endings.\nBy relaying messages through Sieve redirects or submission relays, an attacker can manipulate the data stream interpreted by downstream mail servers. This behavior mirrors the vulnerability class identified in CVE-2023-51764 and CVE-2023-51766.\nThe primary risk involves the potential for email spoofing and command injection on downstream SMTP servers that do not properly handle bare carriage returns (CR) or non-standard line endings in the DATA segment. The vulnerability requires the attacker to control the message content and utilize a relay mechanism such as Sieve or submission services.\nSuccessful exploitation allows an attacker to bypass outbound protections, potentially causing downstream servers to interpret data content as protocol-level commands. This could lead to unauthorized message injection, spoofed sender identities, and potentially broader command execution depending on the configuration of the downstream mail transfer agent (MTA).\nOrganizations relying on Dovecot should prioritize updates to patched versions and ensure that receiving mail infrastructure strictly adheres to SMTP standards regarding message data termination sequences.",
  "technicalDetails": "The vulnerability originates from inadequate sanitization of message content during the relay process in Dovecot. When Dovecot handles outbound mail—specifically via Sieve redirect or submission relay—it fails to neutralize specific character sequences within the message body that function as line endings. In the context of SMTP protocol state machines, the DATA command is terminated by a sequence containing a period on a new line (CRLF.CRLF).\nIf an attacker successfully crafts a message body that includes specific, non-standard line endings (such as bare carriage returns), they can induce 'SMTP smuggling.' This technique exploits discrepancies in how different SMTP implementations interpret the end-of-data sequence. Specifically, if a downstream server is not hardened against smuggled characters, it may prematurely terminate the DATA state upon encountering a smuggled end-of-data sequence, while the original sending server continues to transmit the remainder of the email body.\nThe attack flow proceeds as follows: First, the attacker uses an authenticated session or an automated mechanism like Sieve to initiate a message relay through the vulnerable Dovecot instance. Second, the attacker embeds a payload within the message body, specifically utilizing crafted line endings designed to be interpreted as protocol commands by a subsequent MTA. Third, the Dovecot instance forwards this payload to the downstream server without properly sanitizing the injected character sequences.\nThe downstream server, if vulnerable to SMTP smuggling, interprets the smuggled sequence as an 'End-of-Data' command. Consequently, the downstream server closes the current mail transaction and treats any subsequent lines in the body—which were intended to be part of the original message—as new, independent SMTP commands. This allows the attacker to issue commands like 'MAIL FROM' or 'RCPT TO' that appear to originate from the legitimate relay server, effectively spoofing internal communications or bypassing security headers.\nThe technical root cause is a failure in the Dovecot submission or redirect logic to validate or rewrite line-ending sequences according to RFC 5321 standards before handing the stream off to a downstream hop. This vulnerability is significant because it shifts the interpretation of data content into the command stream of the receiving infrastructure, circumventing the expected boundaries of the SMTP protocol. The impact is primarily the loss of message integrity and the potential for authenticated command injection if the downstream MTA does not strictly reject illegal character sequences in the DATA stream."
}