Hi all, hi Aki,
On 2026-08-28 12:07:23, Aki Tuomi via dovecot wrote:
- CVE-2026-40203: When IMAP COMPRESS=DEFLATE was enabled, an attacker could send mails into a victim's mailbox and observe network traffic to determine whether a secret message matched a known string by comparing compressed response sizes (a CRIME-style attack). The fix resets the compression dictionary after each IMAP command, preventing information from leaking between commands. Commit: https://github.com/dovecot/core/commit/bc04ca866cbdd9a3228816fbc302c2024d207...
...
- imap: Change imap_compress_on_proxy default to yes. These two changes together break backward compatibility for 2.4.5 backends with before-2.4.4 proxy frontends. The old frontends cannot handle "dict_reset" (imap_proxy_side_channel_input()) yet but the backend repeatedly sends them. The log on the proxy repeatedly complains:
imap-login: Error: proxy(REDACTED): Side channel input: dict_reset: Unsupported command: user=<REDACTED>, method=PLAIN, rip=REDACTED, lip=REDACTED, TLS, session=<HkufcGla0PWPXeFu>
and the client (Thunderbird) did not display any new mail but also *no errors*. TB just silently cut the user off from any updates in the IMAP mailbox. I did not test how other clients would have reacted. I assume any client not enabling compression would be not affected at all.
As a workaround I disabled imap_compress_on_proxy again on the backend, now explicitly due to the changed default. I'm not sure if this also reverts/masks the fix for CVE-2026-40203 but at least, it fixes the DoS the changes caused in our setup. Aki, Timo, do you think *DISABLING* IMAP compress support completely is a more secure workaround with respect to CVE-2026-40203?
I will try to enable imap_compress_on_proxy again once all proxy frontends have been updated to 2.4.5.
I hope this mail helps others to avoid a long debugging session. ;-)
Patrick Cernko <pcernko@mpi-klsb.mpg.de> +49 681 9325 5815 Joint Scientific IT and Technical Service Max-Planck-Institute für Informatik & Softwaresysteme