dovecot: Dovecot: Denial of Service in ManageSieve login process

A flaw was found in Dovecot. An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. This can lead to a denial of service for Sieve script management, affecting either the attacker's connection or all connections handled by t...

dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve

A flaw was found in Dovecot's ManageSieve login process. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted, truncated quoted argument. This action causes the process to enter an infinite loop, consuming excessive CPU resources. Repeated exploitation can lea...

Important: Red Hat Security Advisory: dovecot security update

An update for dovecot is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve

A flaw was found in Dovecot's ManageSieve login process. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted, truncated quoted argument. This action causes the process to enter an infinite loop, consuming excessive CPU resources. Repeated exploitation can lea...

dovecot: Dovecot: Denial of Service in ManageSieve login process

A flaw was found in Dovecot. An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. This can lead to a denial of service for Sieve script management, affecting either the attacker's connection or all connections handled by t...

Important: Red Hat Security Advisory: dovecot security update

An update for dovecot is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

EUVD-2026-123334

The auto-ban of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 can be kept from banning an address after repeated failed logons, which allows a remote unauthenticated attacker who can connect from two or more addresses to go on guessing account passwords - over SMTP AUTH, IMAP and POP3, and...

CVE-2026-126618

Progressive Robot hMailServer versions 6.0.0-B1 through 6.3.7 are vulnerable to an improper restriction of excessive authentication attempts . The vulnerability allows a remote unauthenticated attacker to bypass the auto-ban mechanism during brute-force attacks on protocols including SMTP AUTH, I...

CVE-2026-76168 Apache James: ManageSieve file implementation cross-user path traversal

In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users. This allows a logged in attacker to set arbitrary SIEVE scripts for other users, resulting in...

CVE-2026-76168

Versions of the Apache James server prior to 3.9.1 are vulnerable to a path traversal flaw within the SieveFileRepository component. This issue stems from incorrect validation of file paths, which allows a logged-in attacker to set arbitrary SIEVE scripts for other users. Practical consequences i...

CentOS Linux 7 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1793089374)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1793089374 advisory. - An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If...

Alibaba Cloud Linux 3 : 0327: dovecot (ALINUX3-SA-2026:0327)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0327 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-27852: An attacker that can send...

CLSA-2026-1792570553 dovecot: Fix of 7 CVEs

CVE-2026-27852: bound the transient RFC 2231 parameter list and the MIME parameter budget so a single oversized Content-Type header cannot exhaust imap memory - CVE-2026-33263: track SMTP server connection closure so submission-login does not keep using a closed connection - CVE-2026-33605: fix...

AlmaLinux 9.2 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792570553)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792570553 advisory. - An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME...

RHEL 9 : dovecot (RHSA-2026:80825)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:80825 advisory. Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3...

Oracle Linux 9 : dovecot (ELSA-2026-80825)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-80825 advisory. - fix CVE-2026-33605: ManageSieve protocol denial of service via lone CR character RHEL-251989 - fix CVE-2026-42007: use-after-free in pigeonhole...

AlmaLinux 9 : dovecot (ALSA-2026:80825)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:80825 advisory. dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters CVE-2026-42391 dovecot: Dovecot: Authentication bypass via incorrect...

Astra Linux – vulnerability in dovecot

The ManageSieve AUTHENTICATE command crashes when using a literal value as the initial SASL response. This can be exploited to repeatedly crash the ManageSieve service, rendering it unavailable to other users. Access control to the ManageSieve port should be tightened; if the service is not...

Astra Linux – vulnerability in dovecot

An attacker can upload a malicious Sieve script to the ManageSieve service or locally to bypass the configured CPU time limits for Sieve by up to 130 times the set limit. This allows the attacker to degrade server performance and circumvent the imposed CPU time limits on Sieve scripts. One soluti...

CentOS Linux 8.4 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1792238249)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1792238249 advisory. - An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME...