An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, causing denial of service for the affected user. Update to non-vulnerable version. No publicly available exploits are known.

An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, causing denial of service for the affected user. Update to non-vulnerable version. No publicly available exploits are known.

dovecot24-2.4.5-1.1 on GA media

dovecot: Dovecot: Denial of service via crafted email headers dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion dovecot: Dovecot: Denial of Service in ManageSieve login process dovecot: Dovecot: MySQL multi-byte escaping wrong dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation

Affected: Rocky Linux:8: dovecot

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.

Security Fix(es):

* dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)

* dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)

* dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)

* dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)

* dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)

* dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)

* dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)

* dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)

Bug Fix(es) and Enhancement(s):

* Dovecot crashes when accessing mailbox with: "Panic: file mail-user.c: line 229 (mail_user_deinit): assertion failed: ((*user)->refcount == 1)" (JIRA:Rocky Linux-176273)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Security update for dovecot24

Affected: Ubuntu:Pro:14.04:LTS: dovecot, Ubuntu:16.04:LTS: dovecot, Ubuntu:18.04:LTS: dovecot, Ubuntu:20.04:LTS: dovecot, Ubuntu:22.04:LTS: dovecot, Ubuntu:24.04:LTS: dovecot, Ubuntu:26.04:LTS: dovecot

An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, causing denial of service for the affected user. Update to non-vulnerable version. No publicly available exploits are known.

Ein Angreifer kann mehrere Schwachstellen in Dovecot ausnutzen, um Sicherheitsvorkehrungen zu umgehen, sensible Informationen offenzulegen, Daten zu manipulieren oder Denial-of-Service-Zustände herbeizuführen.