Description

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of the secret, which reduces the effort needed to guess it. The secret value itself is not disclosed. Restrict network access to the doveadm service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-08-28T12:16:29.763Z",
  "pubdate": "2026-08-28T12:16:29.763Z",
  "executiveSummary": "The doveadm service is affected by a timing side-channel vulnerability during the validation of passwords and API keys. The implementation utilizes a non-constant time string comparison mechanism, which allows an attacker to infer the length of the configured secret based on response latency variations.\nThis vulnerability resides within the authentication logic of the doveadm service. By measuring the time taken for the server to process repeated authentication requests, a remote attacker positioned on the same network can statistically analyze timing differences to determine the exact length of the secret key.\nWhile the specific secret value is not directly exposed, determining the length significantly reduces the entropy space for subsequent brute-force or dictionary-based attacks. The exploit requires network proximity to the doveadm service and the ability to perform high-resolution timing measurements. No public exploits are currently known, but the risk remains significant for environments where doveadm is exposed to untrusted network segments. Remediation requires updating the software to a version implementing constant-time comparison functions.",
  "technicalDetails": "The root cause of this vulnerability is the use of a non-constant time comparison function when validating authentication tokens or passwords within the doveadm service. In standard string comparison operations, the comparison process typically terminates as soon as a character mismatch is identified (a 'short-circuit' evaluation). Because the processing time is directly proportional to the number of matching prefix characters, an observer can measure these minute fluctuations to deduce information about the secret.\nThe attack flow follows a side-channel methodology. An attacker initiates repeated authentication attempts against the doveadm service while carefully measuring the time the server takes to respond to each request. By observing the timing variance across a high volume of requests, the attacker can identify how the processing duration correlates with the length of the input. Because the comparison logic fails to normalize the execution time, the total latency increases linearly as the attacker's supplied probe approaches the length of the actual secret.\nThe vulnerable component is the authentication routine used by doveadm for API keys and password verification. Because these secrets are sensitive, any leakage—even partial information such as the length—weakens the overall security posture. By successfully identifying the length, the attacker effectively narrows the search space for brute-force operations, making it computationally cheaper to recover the full secret.\nExploitation requires the attacker to have network-level access to the doveadm service. In environments where the service is exposed to the local network or internet, this timing analysis can be performed remotely. However, the accuracy of the measurements is subject to network jitter and system load; thus, the attacker must employ statistical techniques to filter noise and isolate the signal provided by the non-constant time comparison. Once the length is established, the adversary can focus their efforts on cracking a specific length, dramatically increasing the efficiency of an unauthorized access attempt. The post-exploitation impact is the potential compromise of the doveadm administrative interface, granting the attacker control over mail store management operations."
}