https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T11:07:27.988741+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:13498 ALSA-2026:13498 — Important: dovecot security update 2026-10-02T11:07:28.203299+00:00

Affected: AlmaLinux:10: dovecot, AlmaLinux:10: dovecot-devel, AlmaLinux:10: dovecot-mysql, AlmaLinux:10: dovecot-pgsql, AlmaLinux:10: dovecot-pigeonhole

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.

Security Fix(es):

* dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032) * dovecot: denial of service via crafted message before authentication (CVE-2026-27858) * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2026-10399 bdu:2026-10399 2026-10-02T11:07:28.203372+00:00 bdu:2026-10399 https://cve.radiocsirt.org/vuln/euvd-2026-337735 EUVD-2026-337735 2026-10-02T11:07:28.203389+00:00 EUVD-2026-337735 https://cve.radiocsirt.org/vuln/fkie_cve-2025-59032 fkie_cve-2025-59032 2026-10-02T11:07:28.203402+00:00

ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version. No publicly available exploits are known.

 https://cve.radiocsirt.org/vuln/ghsa-w2gj-cmfm-c4j4 GHSA-w2gj-cmfm-c4j4 2026-10-02T11:07:28.203425+00:00

ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version. No publicly available exploits are known.

 https://cve.radiocsirt.org/vuln/oesa-2026-1849 OESA-2026-1849 — dovecot security update 2026-10-02T11:07:28.203441+00:00

Affected: openEuler:22.03-LTS-SP4: dovecot, openEuler:24.03-LTS: dovecot, openEuler:24.03-LTS-SP1: dovecot, openEuler:24.03-LTS-SP2: dovecot, openEuler:24.03-LTS-SP3: dovecot, openEuler:20.03-LTS-SP4: dovecot

Dovecot is an IMAP server for Linux/UNIX-like systemsa wrapper package that will just handle common things for all versioned dovecot packages. Security Fix(es):

Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subsequently ending up in FTS indexes. Do not use the provided script, instead, use something else like FTS tika. No publicly available exploits are known.(CVE-2025-59031)

ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version. No publicly available exploits are known.(CVE-2025-59032)

When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added to allowed characters, path traversal can happen if the domain component is directory partial. This allows inadvertently reading /etc/passwd (or some other path which ends with passwd). If this file contains passwords, it can be used to authenticate wrongly, or if this is userdb, it can unexpectly make system users appear valid users. Upgrade to fixed version, or use different authentication scheme that does not rel…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10442-1 openSUSE-SU-2026:10442-1 — dovecot24-2.4.3-1.1 on GA media 2026-10-02T11:07:28.203494+00:00

dovecot24-2.4.3-1.1 on GA media

 https://cve.radiocsirt.org/vuln/oxdc-adv-2026-0001 OXDC-ADV-2026-0001 — OX Dovecot Security Advisory OXDC-ADV-2026-0001 2026-10-02T11:07:28.203517+00:00 OXDC-ADV-2026-0001 https://cve.radiocsirt.org/vuln/rhsa-2026:17602 RHSA-2026:17602 — Red Hat Security Advisory: dovecot security update 2026-10-02T11:07:28.203538+00:00

dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command dovecot: denial of service via specially crafted NOOP command dovecot: denial of service via crafted message before authentication

 https://cve.radiocsirt.org/vuln/rlsa-2026:19149 RLSA-2026:19149 — Important: dovecot security update 2026-10-02T11:07:28.203557+00:00

Affected: Rocky Linux:10: dovecot

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.

Security Fix(es):

* dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032)

* dovecot: denial of service via crafted message before authentication (CVE-2026-27858)

* dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:1641-1 SUSE-SU-2026:1641-1 — Security update for dovecot22 2026-10-02T11:07:28.203582+00:00

Security update for dovecot22

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-59032 UBUNTU-CVE-2025-59032 2026-10-02T11:07:28.203600+00:00

Affected: Ubuntu:Pro:14.04:LTS: dovecot, Ubuntu:16.04:LTS: dovecot, Ubuntu:18.04:LTS: dovecot, Ubuntu:20.04:LTS: dovecot, Ubuntu:22.04:LTS: dovecot, Ubuntu:24.04:LTS: dovecot, Ubuntu:25.10: dovecot

ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version. No publicly available exploits are known.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0891 WID-SEC-W-2026-0891 — Dovecot: Mehrere Schwachstellen 2026-10-02T11:07:28.203627+00:00

Ein Angreifer kann mehrere Schwachstellen in Dovecot ausnutzen, um SQL-Injection-Angriffe durchzuführen, die Authentifizierung zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand herbeizuführen.