Open-Xchange vulnerabilities
We track 29 vulnerabilities in Open-Xchange products across 7 products. 29 are rated high or critical, and none are known to be exploited. The most recent was published on August 28, 2026.
Latest Open-Xchange vulnerabilities
- 7.4 High severity
OX Dovecot Pro: Improper Authentication
An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are differ
- 7.5 High severity
OX Dovecot Pro: Uncontrolled Resource Consumption
An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also termin
- 9.1 Critical severity
OX Dovecot Pro: Use After Free
An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and oppor
- 7.5 High severity
OX Dovecot Pro: Uncontrolled Resource Consumption
An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode (default for community releases), only the attacker's own connection is terminated. If running in h
- 7.5 High severity
OX Dovecot Pro: Uncontrolled Resource Consumption
An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it o
- 9.1 Critical severity
OX Dovecot Pro: Improper Handling of Extra Parameters
When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using sa
- 7.5 High severity
OX Dovecot Pro: Uncontrolled Resource Consumption
Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol
- 7.5 High severity
OX Dovecot Pro: Uncontrolled Resource Consumption
Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection. This 1 MB can be left allocated for longer time periods by not sending the command ending LF. So attacker
- 8.2 High severity
OX Dovecot Pro: Improper Neutralization of Special Elements used in an SQL Command
Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed
- 7.5 High severity
ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response.
ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it's not needed
- 7.5 High severity
When sending invalid base64 SASL data, login process is disconnected from the auth server…
When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. Install fixed version or disab
- 7.4 High severity
OX Dovecot Pro: Improper Preservation of Consistency Between Independent Representations of Shared State
When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users. After cached login, all subsequent logins are for same user. Install fixed version or disable cachin
- 7.5 High severity
OX App Suite: Uncontrolled Resource Consumption
Malicious or unintentional API requests can be used to add significant amount of data to caches. Caches may evict information that is required to operate the web frontend, which leads to unavailability of the component. Please deploy the provided updates and p
- 7.5 High severity
OX Dovecot Pro: Allocation of Resources Without Limits or Throttling
Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the message. However, when it feeds them to message-header-parser, it starts building up "full_value" buffer out of the smaller
- 8.8 High severity
Firefox: Improper Check for Unusual or Exceptional Conditions
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
- 8.1 High severity
OX App Suite: Improper Access Control
User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable the feature by default was not effective in this case. Unauthorized users could discover and modify application state, incl
- 9.6 Critical severity
OX App Suite: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hierarchy. Unauthorized users could break confidentiality of information in the directory and potential
- 8.8 High severity
OX App Suite: Improper Neutralization of Special Elements used in an OS Command
A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confident
- 7.3 High severity
OX App Suite: Improper Neutralization of Special Elements used in an SQL Command
Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements. An attacker with access to the adjacent network and potentially API credentials, could read and modify
- 7.8 High severity
OX App Suite: Improper Authentication
RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI service to modify calendar items using RMI. RMI access is restricted to localhost by default. The interfa
- 8.8 High severity
OX App Suite: Improper Neutralization of Special Elements used in an SQL Command
Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by defa
- 8.8 High severity
OX App Suite: Improper Neutralization of Special Elements used in an SQL Command
Requests to cache an image could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. A
- 8.8 High severity
OX App Suite: Improper Neutralization of Special Elements used in an SQL Command
Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to publi
- 7.5 High severity
OX App Suite: Use of Insufficiently Random Values
Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be used to intercept and take over the client authorization proces
- 9.8 Critical severity
OX App Suite: Improper Neutralization of Special Elements used in an SQL Command
Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this can be abused to trigger benign SQL Exceptions but could potentially be escalated to a malicious SQL injection vulnerabili
- 7.8 High severity
OX App Suite: Improper Neutralization of Special Elements used in an SQL Command
The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be executed when creating new cache groups. Attackers with access to a local or restricted network could perform arbitrary S
- 7.8 High severity
OX App Suite: Improper Neutralization of Special Elements used in an SQL Command
The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL statement. Attackers with access to a local or restricted network were able to perform arbitrary SQL queries, discoverin
- 8.8 High severity
OX App Suite: Deserialization of Untrusted Data
Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization. Access to this API endpoint is restricted to local networks by default. Arbitrary code could be injected
- 9.8 Critical severity
Ox App Suite: Improper Neutralization of Special Elements used in an OS Command
documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occur for an EPS document that is disguised as a PDF document.