mailinabox

Mail-in-a-Box By @JoshData and contributors. Mail-in-a-Box helps individuals take back control of their email by defining a one-click, easy-to-deploy SMTP+everything else server: a mail server in a box. Please seehttps://mailinabox.email for the project's website and setup guide! Our goals are to...

CVE-2026-24031

CVE-2026-24031: Dovecot SQL authentication bypass authentication + user enumeration This repository contains a proof-of-concept authentication-bypass exploit for CVE-2026-24031 , a SQL injection in Dovecot's SQL-based authentication introduced as a regression in Dovecot 2.4.0 / 3.1.0. In the test...

CLSA-2026-1792596933 dovecot: Fix of CVE-2026-42007

CVE-2026-42007: pigeonhole: sieve editheader: reset header-index first pointers before rebuilding the index and copy raw header data with memcpy instead of istrndup...

CLSA-2026-1792570553 dovecot: Fix of 7 CVEs

CVE-2026-27852: bound the transient RFC 2231 parameter list and the MIME parameter budget so a single oversized Content-Type header cannot exhaust imap memory - CVE-2026-33263: track SMTP server connection closure so submission-login does not keep using a closed connection - CVE-2026-33605: fix...

CLSA-2026-1790599296 dovecot: Fix of CVE-2026-27856

rebase to 2.2.36-8.0.3.el7 - the vendor fixes in this build: CVE-2025-59032, CVE-2026-27856, CVE-2026-42006 - drop the 2 TuxCare CVE backports; the vendor now ships their own patches for them - no TuxCare CVE patches remain...

Astra Linux – Vulnerability in dovecot

The submission service in Dovecot before 2.3.15 allowed for STARTTLS command injection in the lib-smtp library. Sensitive information could be redirected to an address controlled by the attacker...

Astra Linux – Vulnerability in dovecot

The attacker can use a specially crafted Base64 exchange between Dovecot and the client to forge SCRAM TLS channel bindings. This requires that the attacker be able to position themselves between Dovecot and the client connection. If successful, the attacker can eavesdrop on communications betwee...

Astra Linux – vulnerability in dovecot

Very large headers can cause resource exhaustion when parsing messages. The message parser normally reads message chunks of reasonable size. However, when it feeds these chunks to the message header parser, it begins building the “fullvalue” buffer from the smaller chunks. The “fullvalue” buffer...

Astra Linux – Vulnerability in dovecot

Dovecot OTP authentication is vulnerable to replay attacks under certain conditions. If the auth cache is enabled, and the username is changed in passdb, then the OTP credentials can be cached, making the same OTP response valid. An attacker who can observe the OTP exchange can log in as the user...

Astra Linux – Vulnerability in dovecot

The ManageSieve AUTHENTICATE command crashes when using “literal” as the initial response to SASL. This can be used to repeatedly crash the ManageSieve service, rendering it unavailable to other users. It’s recommended to control access to the ManageSieve port or disable the service if it’s not...

MiracleLinux 9 : dovecot-2.3.16-18.el9_8.8 (AXSA:2026-2051:08)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2051:08 advisory. dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters CVE-2026-42391 dovecot: Dovecot: Authentication bypass via incorre...

dovecot security update

An update is available for dovecot. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Dovecot is an IMAP server for Linux and other UNIX-like systems, written...

RLSA-2026:80825 Important: dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fixes: doveco...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: dovecot (UTSA-2026-130079)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130079 advisory. An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: dovecot (UTSA-2026-130078)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130078 advisory. An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: dovecot (UTSA-2026-130075)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130075 advisory. An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: dovecot (UTSA-2026-130077)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130077 advisory. When mailmaxuseripconnections is set default 10 and reached, submission-login can crash with epoll panic caused by file descriptor handling issues. If running in...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: dovecot (UTSA-2026-130080)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130080 advisory. None None None No publicly available exploits are known. Tenable has extracted the preceding description block directly from the Unity Linux security advisory. Note...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: dovecot (UTSA-2026-130073)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130073 advisory. An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: dovecot (UTSA-2026-130082)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130082 advisory. An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode...