https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 14:11:16 +0000 https://cve.radiocsirt.org/vuln/alsa-2024:6529 <p><strong>Affected:</strong> AlmaLinux:9: dovecot, AlmaLinux:9: dovecot-devel, AlmaLinux:9: dovecot-mysql, AlmaLinux:9: dovecot-pgsql, AlmaLinux:9: dovecot-pigeonhole</p> <p>Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.</p> <p>Security Fix(es):</p> <p>* dovecot: using a large number of address headers may trigger a denial of service (CVE-2024-23184) * dovecot: very large headers can cause resource exhaustion when parsing message (CVE-2024-23185)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: dovecot, AlmaLinux:9: dovecot-devel, AlmaLinux:9: dovecot-mysql, AlmaLinux:9: dovecot-pgsql, AlmaLinux:9: dovecot-pigeonhole</p> <p>Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.</p> <p>Security Fix(es):</p> <p>* dovecot: using a large number of address headers may trigger a denial of service (CVE-2024-23184) * dovecot: very large headers can cause resource exhaustion when parsing message (CVE-2024-23185)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2024:6529 https://cve.radiocsirt.org/vuln/bdu:2024-08624 bdu:2024-08624 https://cve.radiocsirt.org/vuln/bdu:2024-08624 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0710 certfr-2024-avi-0710 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0710 https://cve.radiocsirt.org/vuln/euvd-2026-258880 EUVD-2026-258880 https://cve.radiocsirt.org/vuln/euvd-2026-258880 https://cve.radiocsirt.org/vuln/fkie_cve-2024-23185 <p>Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the message. However, when it feeds them to message-header-parser, it starts building up &#34;full_value&#34; buffer out of the smaller chunks. The full_value buffer has no size limit, so large headers can cause large memory usage. It doesn&#39;t matter whether it&#39;s a single long header line, or a single header split into multiple lines. This bug exists in all Dovecot versions. Incoming mails typically have some size limits set by MTA, so even largest possible header size may still fit into Dovecot&#39;s vsz_limit. So attackers probably can&#39;t DoS a victim user this way. A user could APPEND larger mails though, allowing them to DoS themselves (although maybe cause some memory issues for the backend in general). One can implement restrictions on headers on MTA component preceding Dovecot. No publicly available exploits are known.</p> <p>Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the message. However, when it feeds them to message-header-parser, it starts building up &#34;full_value&#34; buffer out of the smaller chunks. The full_value buffer has no size limit, so large headers can cause large memory usage. It doesn&#39;t matter whether it&#39;s a single long header line, or a single header split into multiple lines. This bug exists in all Dovecot versions. Incoming mails typically have some size limits set by MTA, so even largest possible header size may still fit into Dovecot&#39;s vsz_limit. So attackers probably can&#39;t DoS a victim user this way. A user could APPEND larger mails though, allowing them to DoS themselves (although maybe cause some memory issues for the backend in general). One can implement restrictions on headers on MTA component preceding Dovecot. No publicly available exploits are known.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-23185 https://cve.radiocsirt.org/vuln/ghsa-g9m4-c8qf-67qw <p>Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the message. However, when it feeds them to message-header-parser, it starts building up &#34;full_value&#34; buffer out of the smaller chunks. The full_value buffer has no size limit, so large headers can cause large memory usage. It doesn&#39;t matter whether it&#39;s a single long header line, or a single header split into multiple lines. This bug exists in all Dovecot versions. Incoming mails typically have some size limits set by MTA, so even largest possible header size may still fit into Dovecot&#39;s vsz_limit. So attackers probably can&#39;t DoS a victim user this way. A user could APPEND larger mails though, allowing them to DoS themselves (although maybe cause some memory issues for the backend in general). One can implement restrictions on headers on MTA component preceding Dovecot. No publicly available exploits are known.</p> <p>Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the message. However, when it feeds them to message-header-parser, it starts building up &#34;full_value&#34; buffer out of the smaller chunks. The full_value buffer has no size limit, so large headers can cause large memory usage. It doesn&#39;t matter whether it&#39;s a single long header line, or a single header split into multiple lines. This bug exists in all Dovecot versions. Incoming mails typically have some size limits set by MTA, so even largest possible header size may still fit into Dovecot&#39;s vsz_limit. So attackers probably can&#39;t DoS a victim user this way. A user could APPEND larger mails though, allowing them to DoS themselves (although maybe cause some memory issues for the backend in general). One can implement restrictions on headers on MTA component preceding Dovecot. No publicly available exploits are known.</p> https://cve.radiocsirt.org/vuln/ghsa-g9m4-c8qf-67qw https://cve.radiocsirt.org/vuln/gsd-2024-23185 gsd-2024-23185 https://cve.radiocsirt.org/vuln/gsd-2024-23185 https://cve.radiocsirt.org/vuln/oesa-2024-2009 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP1: dovecot, openEuler:24.03-LTS: dovecot, openEuler:22.03-LTS-SP4: dovecot, openEuler:22.03-LTS-SP3: dovecot, openEuler:20.03-LTS-SP4: dovecot</p> <p>Dovecot is an IMAP server for Linux/UNIX-like systemsa wrapper package that will just handle common things for all versioned dovecot packages.</p> <p>Security Fix(es):</p> <p>(CVE-2024-23184)</p> <p>(CVE-2024-23185)</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP1: dovecot, openEuler:24.03-LTS: dovecot, openEuler:22.03-LTS-SP4: dovecot, openEuler:22.03-LTS-SP3: dovecot, openEuler:20.03-LTS-SP4: dovecot</p> <p>Dovecot is an IMAP server for Linux/UNIX-like systemsa wrapper package that will just handle common things for all versioned dovecot packages.</p> <p>Security Fix(es):</p> <p>(CVE-2024-23184)</p> <p>(CVE-2024-23185)</p> https://cve.radiocsirt.org/vuln/oesa-2024-2009 https://cve.radiocsirt.org/vuln/opensuse-su-2024:14274-1 <p>dovecot23-2.3.21.1-1.1 on GA media</p> <p>dovecot23-2.3.21.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:14274-1 https://cve.radiocsirt.org/vuln/oxdc-adv-2024-0003 OXDC-ADV-2024-0003 https://cve.radiocsirt.org/vuln/oxdc-adv-2024-0003 https://cve.radiocsirt.org/vuln/rhsa-2024:6465 <p>dovecot: using a large number of address headers may trigger a denial of service dovecot: very large headers can cause resource exhaustion when parsing message</p> <p>dovecot: using a large number of address headers may trigger a denial of service dovecot: very large headers can cause resource exhaustion when parsing message</p> https://cve.radiocsirt.org/vuln/rhsa-2024:6465 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-23185 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: dovecot, Ubuntu:16.04:LTS: dovecot, Ubuntu:18.04:LTS: dovecot, Ubuntu:20.04:LTS: dovecot, Ubuntu:22.04:LTS: dovecot, Ubuntu:24.04:LTS: dovecot</p> <p>Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the message. However, when it feeds them to message-header-parser, it starts building up &#34;full_value&#34; buffer out of the smaller chunks. The full_value buffer has no size limit, so large headers can cause large memory usage. It doesn&#39;t matter whether it&#39;s a single long header line, or a single header split into multiple lines. This bug exists in all Dovecot versions. Incoming mails typically have some size limits set by MTA, so even largest possible header size may still fit into Dovecot&#39;s vsz_limit. So attackers probably can&#39;t DoS a victim user this way. A user could APPEND larger mails though, allowing them to DoS themselves (although maybe cause some memory issues for the backend in general). One can implement restrictions on headers on MTA component preceding Dovecot. No publicly available exploits are known.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: dovecot, Ubuntu:16.04:LTS: dovecot, Ubuntu:18.04:LTS: dovecot, Ubuntu:20.04:LTS: dovecot, Ubuntu:22.04:LTS: dovecot, Ubuntu:24.04:LTS: dovecot</p> <p>Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the message. However, when it feeds them to message-header-parser, it starts building up &#34;full_value&#34; buffer out of the smaller chunks. The full_value buffer has no size limit, so large headers can cause large memory usage. It doesn&#39;t matter whether it&#39;s a single long header line, or a single header split into multiple lines. This bug exists in all Dovecot versions. Incoming mails typically have some size limits set by MTA, so even largest possible header size may still fit into Dovecot&#39;s vsz_limit. So attackers probably can&#39;t DoS a victim user this way. A user could APPEND larger mails though, allowing them to DoS themselves (although maybe cause some memory issues for the backend in general). One can implement restrictions on headers on MTA component preceding Dovecot. No publicly available exploits are known.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-23185 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1867 <p>Ein entfernter Angreifer kann mehrere Schwachstellen in Dovecot ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter Angreifer kann mehrere Schwachstellen in Dovecot ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1867