CVE-2026-24031

CVE-2026-24031: Bypass de autenticación SQL en Dovecot autenticación + enumeración de usuarios Este repositorio contiene un exploit de prueba de concepto para eludir la autenticación de CVE-2026-24031 , una inyección SQL en la autenticación basada en SQL de Dovecot introducida como regresión en...

mailinabox

Mail-in-a-Box 作者 @JoshData 和贡献者。 Mail-in-a-Box 通过提供一台一键式、易于部署的 SMTP+全套服务服务器，帮助个人重新掌控自己的电子邮件：一个装在盒子里的邮件服务器。 请访问https://mailinabox.email 查看项目网站和设置指南！ 我们的目标是： 让部署优秀的邮件服务器变得简单。 促进互联网的去中心化、创新和隐私保护。 拥有自动化、可审计且幂等的配置。 不 打造一个完全不可入侵、NSA 也无法攻破的服务器。 不 做成一个可供高级用户自定义的东西。 此外，本项目还有一份行为准则，其优先级高于上述目标。加入我们的社区时，请先阅读...

CVE-2026-42391

A flaw was found in Dovecot. An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in. This action causes the server to consume excessive memory and CPU resources, leading to the termination of login processes and other active connections...

CVE-2026-42393

A flaw was found in dovecot. The comparison mechanism for doveadm passwords and API keys is not fully timing safe. A remote attacker, with network access to the doveadm service, could repeatedly make requests and accurately measure response timings. This could allow the attacker to learn the leng...

CVE-2026-40203

A flaw was found in dovecot where, when IMAP compression is enabled, the system reuses the same compression state across responses within a session. This allows a remote attacker, who can send mail to a user and monitor the sizes of their IMAP traffic, to potentially deduce the content of small...

CVE-2026-73209

A flaw was found in Dovecot. An authenticated attacker can send specially crafted compressed data, leading to the affected process exhausting its stack and crashing. This termination of the process can result in degradation or a complete denial of service for the IMAP Internet Message Access...

CVE-2026-52687

A flaw was found in dovecot. A remote attacker with valid credentials can exploit this vulnerability by selecting a compression algorithm for the IMAP connection that requires a large amount of memory for decompression. By opening several such connections, the attacker can exhaust the process's...

CVE-2026-42395

A flaw was found in Dovecot. A remote attacker, if able to send forwarding information from a host configured as a trusted proxy, could send a NUL byte that crashes the login process. This termination of the login process can lead to a denial of service for user logins. Mitigation To mitigate thi...

CVE-2026-42392

A flaw was found in Dovecot. An attacker with valid credentials can send an invalid IMAP URLFETCH command, leading to the inclusion of uninitialized memory in the error response. This can disclose process memory contents to the client, potentially revealing sensitive data. Mitigation To mitigate...

CVE-2026-42008

A flaw was found in Dovecot. Forwarded information from a host listed as a trusted proxy is not properly separated from Dovecot's internal authentication fields. This allows a malicious host configured as a trusted proxy to inject values as internal authentication fields, enabling it to...

CVE-2026-40205

A flaw was found in Dovecot. An attacker with a partially valid OAuth2 token can bypass authorization checks in remote token validation paths. This allows the attacker to authenticate with insufficient permissions, leading to a breach of integrity where the configured authorization policy is not...

CVE-2026-40017

A flaw was found in Dovecot. A remote attacker who can send mail to a user can craft a message header designed to cause collisions in an internal hash table. This manipulation forces the IMAP THREAD command to consume excessive CPU resources, leading to degradation or a complete denial of service...

CVE-2026-40019

A flaw was found in Dovecot's ManageSieve login process. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted, truncated quoted argument. This action causes the process to enter an infinite loop, consuming excessive CPU resources. Repeated exploitation can lea...

CVE-2026-40204

A flaw was found in Dovecot. This vulnerability allows an attacker to bypass Access Control List ACL restrictions through the ldamailboxautocreate feature. This could potentially grant unauthorized access to mailboxes or other restricted resources. Mitigation Mitigation for this issue is either n...

CVE-2026-33604

A flaw was found in Dovecot. A remote attacker can exploit this by crafting a message with a specific line ending. If Dovecot relays this message, it can bypass security protections, allowing the attacker to inject spoofed email into a vulnerable downstream mail server. This vulnerability is...

CVE-2026-40015

A flaw was found in Dovecot's imap-hibernate service. An authenticated attacker can open numerous connections and send malformed commands, leading to an out-of-bounds read. This can intermittently crash the process, interrupting hibernated IMAP sessions and causing a denial of service for affecte...

CVE-2026-40014

A flaw was found in Dovecot. A remote attacker, by sending a specially crafted email message header to a user, can cause the Internet Message Access Protocol IMAP THREAD command to consume excessive CPU resources. When a mail client processes this message, it can lead to degradation or a denial o...

CVE-2026-40013

A flaw was found in Dovecot. An authenticated attacker can submit a specially crafted Sieve script containing an extreme numeric literal to the ManageSieve service. This action triggers an out-of-bounds write during script compilation, leading to memory corruption and a crash of the ManageSieve...

CVE-2026-33607

A flaw was found in Dovecot. An authenticated attacker can exploit a vulnerability in the IMAP LIST command to consume excessive CPU resources. This can lead to a degradation of service or a complete denial of service DoS for the IMAP server, impacting the availability of email services. Mitigati...

CVE-2026-33606

A flaw was found in Dovecot. A malicious user can craft specific mail content that, when an administrator later uses the dsync tool with the stream protocol, is interpreted as dsync commands. This command injection allows the user to modify the state of mailboxes on the destination, including...