2909 matches found
dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free
A flaw was found in Dovecot. An authenticated attacker can use a Sieve script with the editheader extension to trigger a use-after-free vulnerability in the mail editing code. This can lead to memory corruption, potentially crashing the mail delivery process and allowing for arbitrary code...
dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters
A flaw was found in Dovecot. An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in. This action causes the server to consume excessive memory and CPU resources, leading to the termination of login processes and other active connections...
dovecot: Dovecot: Denial of Service in ManageSieve login process
A flaw was found in Dovecot. An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. This can lead to a denial of service for Sieve script management, affecting either the attacker's connection or all connections handled by t...
dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation
A flaw was found in Dovecot. This vulnerability allows an attacker to bypass authentication by exploiting how OAuth2 tokens are validated. If an OAuth2 token response does not include a scope claim, Dovecot incorrectly uses the audience claim in its place for authorization checks. This can lead t...
dovecot: Dovecot: Denial of service via crafted email headers
A flaw was found in dovecot. A remote attacker can craft a malicious email with an excessive number of email addresses or MIME parameters in its headers. When a user attempts to read this message over IMAP, the parsing process consumes an inordinate amount of memory, leading to the termination of...
dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion
A flaw was found in the Dovecot mail server's submission-login component. This vulnerability occurs when the server reaches its maximum allowed user IP connections, leading to a crash due to file descriptor handling issues. This can result in a denial of service, preventing users from sending...
dovecot: Dovecot: MySQL multi-byte escaping wrong
A flaw was found in Dovecot. A remote attacker with high attack complexity could exploit this vulnerability to gain access to sensitive information and modify data without requiring any user interaction or privileges...
Important: Red Hat Security Advisory: dovecot security update
An update for dovecot is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...
dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve
A flaw was found in Dovecot's ManageSieve login process. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted, truncated quoted argument. This action causes the process to enter an infinite loop, consuming excessive CPU resources. Repeated exploitation can lea...
dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation
A flaw was found in Dovecot. This vulnerability allows an attacker to bypass authentication by exploiting how OAuth2 tokens are validated. If an OAuth2 token response does not include a scope claim, Dovecot incorrectly uses the audience claim in its place for authorization checks. This can lead t...
dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve
A flaw was found in Dovecot's ManageSieve login process. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted, truncated quoted argument. This action causes the process to enter an infinite loop, consuming excessive CPU resources. Repeated exploitation can lea...
dovecot: Dovecot: MySQL multi-byte escaping wrong
A flaw was found in Dovecot. A remote attacker with high attack complexity could exploit this vulnerability to gain access to sensitive information and modify data without requiring any user interaction or privileges...
dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion
A flaw was found in the Dovecot mail server's submission-login component. This vulnerability occurs when the server reaches its maximum allowed user IP connections, leading to a crash due to file descriptor handling issues. This can result in a denial of service, preventing users from sending...
dovecot: Dovecot: Denial of Service in ManageSieve login process
A flaw was found in Dovecot. An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. This can lead to a denial of service for Sieve script management, affecting either the attacker's connection or all connections handled by t...
dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free
A flaw was found in Dovecot. An authenticated attacker can use a Sieve script with the editheader extension to trigger a use-after-free vulnerability in the mail editing code. This can lead to memory corruption, potentially crashing the mail delivery process and allowing for arbitrary code...
dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters
A flaw was found in Dovecot. An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in. This action causes the server to consume excessive memory and CPU resources, leading to the termination of login processes and other active connections...
dovecot: Dovecot: Denial of service via crafted email headers
A flaw was found in dovecot. A remote attacker can craft a malicious email with an excessive number of email addresses or MIME parameters in its headers. When a user attempts to read this message over IMAP, the parsing process consumes an inordinate amount of memory, leading to the termination of...
Important: Red Hat Security Advisory: dovecot security update
An update for dovecot is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
mailinabox
Mail-in-a-Box By @JoshData and contributors. Mail-in-a-Box helps individuals take back control of their email by defining a one-click, easy-to-deploy SMTP+everything else server: a mail server in a box. Please seehttps://mailinabox.email for the project's website and setup guide! Our goals are to...
CVE-2026-24031
CVE-2026-24031: Dovecot SQL authentication bypass authentication + user enumeration This repository contains a proof-of-concept authentication-bypass exploit for CVE-2026-24031 , a SQL injection in Dovecot's SQL-based authentication introduced as a regression in Dovecot 2.4.0 / 3.1.0. In the test...