Most recent entries from all

ALSA-2026:13498 — Important: dovecot security update

Affected: AlmaLinux:10: dovecot, AlmaLinux:10: dovecot-devel, AlmaLinux:10: dovecot-mysql, AlmaLinux:10: dovecot-pgsql, AlmaLinux:10: dovecot-pigeonhole

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.

Security Fix(es):

* dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032) * dovecot: denial of service via crafted message before authentication (CVE-2026-27858) * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-10384

EUVD-2026-337402

fkie_cve-2026-27858

Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.

GHSA-xr7v-hj32-mr4r

OESA-2026-1849 — dovecot security update

Affected: openEuler:22.03-LTS-SP4: dovecot, openEuler:24.03-LTS: dovecot, openEuler:24.03-LTS-SP1: dovecot, openEuler:24.03-LTS-SP2: dovecot, openEuler:24.03-LTS-SP3: dovecot, openEuler:20.03-LTS-SP4: dovecot

Dovecot is an IMAP server for Linux/UNIX-like systemsa wrapper package that will just handle common things for all versioned dovecot packages. Security Fix(es):

Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subsequently ending up in FTS indexes. Do not use the provided script, instead, use something else like FTS tika. No publicly available exploits are known.(CVE-2025-59031)

ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version. No publicly available exploits are known.(CVE-2025-59032)

When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added to allowed characters, path traversal can happen if the domain component is directory partial. This allows inadvertently reading /etc/passwd (or some other path which ends with passwd). If this file contains passwords, it can be used to authenticate wrongly, or if this is userdb, it can unexpectly make system users appear valid users. Upgrade to fixed version, or use different authentication scheme that does not rel…

openSUSE-SU-2026:10442-1 — dovecot24-2.4.3-1.1 on GA media

dovecot24-2.4.3-1.1 on GA media

OXDC-ADV-2026-0001 — OX Dovecot Security Advisory OXDC-ADV-2026-0001

OXDC-ADV-2026-0001

RHSA-2026:17602 — Red Hat Security Advisory: dovecot security update

dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command dovecot: denial of service via specially crafted NOOP command dovecot: denial of service via crafted message before authentication

RLSA-2026:19149 — Important: dovecot security update

Affected: Rocky Linux:10: dovecot

Security Fix(es):

* dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032)

* dovecot: denial of service via crafted message before authentication (CVE-2026-27858)

* dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:1641-1 — Security update for dovecot22

Security update for dovecot22

UBUNTU-CVE-2026-27858

Affected: Ubuntu:Pro:14.04:LTS: dovecot, Ubuntu:16.04:LTS: dovecot, Ubuntu:18.04:LTS: dovecot, Ubuntu:20.04:LTS: dovecot, Ubuntu:22.04:LTS: dovecot, Ubuntu:24.04:LTS: dovecot, Ubuntu:25.10: dovecot

WID-SEC-W-2026-0891 — Dovecot: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Dovecot ausnutzen, um SQL-Injection-Angriffe durchzuführen, die Authentifizierung zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand herbeizuführen.