Linux Distros Unpatched Vulnerability : CVE-2021-33515

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled...

Linux Distros Unpatched Vulnerability : CVE-2020-24386

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters,...

Linux Distros Unpatched Vulnerability : CVE-2017-15132

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processe...

Linux Distros Unpatched Vulnerability : CVE-2017-15130

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups,...

Linux Distros Unpatched Vulnerability : CVE-2020-28200

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the reg...

Linux Distros Unpatched Vulnerability : CVE-2014-3430

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dovecot 1.1 before 2.2.13 and dovecot-ee before 2.1.7.7 and 2.2.x before 2.2.12.12 does not properly close old connections, which allows remote attackers to cau...

Linux Distros Unpatched Vulnerability : CVE-2020-12100

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service resource consumption via a...

Linux Distros Unpatched Vulnerability : CVE-2019-3814

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote attacker in possession of a valid...

Linux Distros Unpatched Vulnerability : CVE-2009-3897

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user...

dovecot24-2.4.0-1.1 on GA media (moderate)

dovecot24-2.4.0-1.1 on GA media Announcement ID: openSUSE-SU-2025:14715-1 Rating: moderate Cross-References: CVE-2017-14461 CVE-2017-15130 CVE-2017-15132 CVE-2019-10691 CVE-2019-11494 CVE-2019-11499 CVE-2019-11500 CVE-2019-19722 CVE-2019-3814 CVE-2019-7524 CVE-2020-10957 CVE-2020-10958...

PT-2025-54917

Name of the Vulnerable Software and Affected Versions Dovecot versions prior to 2.4.3 Description Sending invalid base64 SASL data can disrupt the login process by disconnecting it from the authentication server, leading to the failure of all active authentication sessions. This can be used to...

PT-2025-54918

Name of the Vulnerable Software and Affected Versions Dovecot versions prior to 2.4.3 Description Dovecot includes a script for converting attachments to text that improperly handles zip-style attachments. An attacker could leverage specially crafted OOXML documents to cause unintended files on t...

PT-2025-54919

Name of the Vulnerable Software and Affected Versions Dovecot versions prior to 2.4.3 Description A flaw exists in the ManageSieve AUTHENTICATE command that causes the service to crash when a literal value is used as the SASL initial response. This can lead to repeated crashes, resulting in a...

Amazon Linux 2 : dovecot (ALAS-2024-2719)

The version of dovecot installed on the remote host is prior to 2.2.36-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2719 advisory. Dovecot reports: A DoS is possible with a large number of address headers or abnormally large email headers. CVE-2024-23185 Tenabl...

Medium: dovecot

Issue Overview: Dovecot reports: A DoS is possible with a large number of address headers or abnormally large email headers. CVE-2024-23185 Affected Packages: dovecot Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Cor...

Medium: dovecot

Issue Overview: Dovecot reports: A DoS is possible with a large number of address headers or abnormally large email headers. CVE-2024-23185 Affected Packages: dovecot Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Cor...

Medium: dovecot

Issue Overview: Dovecot reports: A DoS is possible with a large number of address headers or abnormally large email headers. CVE-2024-23184 Dovecot reports: A DoS is possible with a large number of address headers or abnormally large email headers. CVE-2024-23185 Affected Packages: dovecot Issue...

Medium: dovecot

Issue Overview: Dovecot reports: A DoS is possible with a large number of address headers or abnormally large email headers. CVE-2024-23184 Dovecot reports: A DoS is possible with a large number of address headers or abnormally large email headers. CVE-2024-23185 Affected Packages: dovecot Issue...

Amazon Linux 2023 : dovecot, dovecot-devel, dovecot-mysql (ALAS2023-2024-785)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-785 advisory. Dovecot reports: A DoS is possible with a large number of address headers or abnormally large email headers. CVE-2024-23184 Dovecot reports: A DoS is possible with a large number of address...

Astra Linux – Vulnerability in dovecot

Having a large number of address headers From, To, Cc, Bcc, etc. can lead to excessive CPU usage. With 100,000 header lines, CPU usage reaches 12 seconds; in a production environment, parsing 500,000 header lines takes 18 minutes. This issue can be triggered by external actors sending emails to...