CVE-2024-25584

Dovecot accepts dot LF DOT LF symbol as end of DATA command. RFC requires that it should always be CR LF DOT CR LF. This causes Dovecot to convert single mail with LF DOT LF in middle, into two emails when relaying to SMTP. Dovecot will split mail with LF DOT LF into two mails. Upgrade to latest released version. No publicly available exploits are known.

• CWE-345

• https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2024/oxdc-adv-2024-0001.json

Published

Sep 6, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-25579OS command injection vulnerability in ELECOM wireless LAN ro…6.8
• CVE-2024-2558A vulnerability was found in Tenda AC18 15.03.05.05. It has …8.8
• CVE-2024-25580An issue was discovered in gui/util/qktxhandler.cpp in Qt be…6.2
• CVE-2024-25581When incoming DNS over HTTPS support is enabled using the ng…7.5
• CVE-2024-25582Module savepoints could be abused to inject references to ma…5.4
• CVE-2024-25583A crafted response from an upstream server the recursor has …7.5
• CVE-2024-2559A vulnerability classified as problematic has been found in …6.5
• CVE-2024-25590An attacker can publish a zone containing specific Resource …7.5
• CVE-2024-25591Exposure of Sensitive Information to an Unauthorized Actor v…7.5
• CVE-2024-25592Improper Neutralization of Input During Web Page Generation …4.8
• CVE-2024-25593Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2024-25594Improper Neutralization of Input During Web Page Generation …5.4