CVE-2026-33263

A flaw was found in the Dovecot mail server's submission-login component. This vulnerability occurs when the server reaches its maximum allowed user IP connections, leading to a crash due to file descriptor handling issues. This can result in a denial of service, preventing users from sending emails, and potentially causing duplicate message delivery under certain conditions.

Red Hat has evaluated this vulnerability as having an Important severity rating because an authenticated user can crash the mail submission service and trigger duplicate message deliveries, compromising both service availability and message integrity. While exploitation requires network access to the submission interface and valid authentication credentials, the resulting process termination causes delivery failures and risk of unintended retransmissions. On Red Hat Enterprise Linux systems, Dovecot enforces per-IP connection limits by default, exposing submission login services to crashes when connection thresholds are exhausted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, limit the number of connections handled by a single submission-login process. This can be achieved by adjusting the process_limit setting for the submission-login service in the Dovecot configuration. For example, add or modify the following in a Dovecot configuration file (e.g., /etc/dovecot/conf.d/10-master.conf):

service submission-login {
  process_limit = <lower_value>
}

Reducing this limit may impact performance. After modifying the configuration, restart the Dovecot service for the changes to take effect.