CVE-2026-33606

A flaw was found in Dovecot. A malicious user can craft specific mail content that, when an administrator later uses the dsync tool with the stream protocol, is interpreted as dsync commands. This command injection allows the user to modify the state of mailboxes on the destination, including internal attributes that should not be directly accessible. This could lead to unauthorized data manipulation and potentially cause service disruptions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, administrators should avoid using the dsync utility with the stream protocol when processing mailboxes that contain untrusted user-provided content. This operational control prevents the crafted mail content from being interpreted as dsync commands during migration or replication tasks.