mailinabox

Mail-in-a-Box By @JoshData and contributors. Mail-in-a-Box helps individuals take back control of their email by defining a one-click, easy-to-deploy SMTP+everything else server: a mail server in a box. Please seehttps://mailinabox.email for the project's website and setup guide! Our goals are to...

CVE-2026-24031

CVE-2026-24031: Dovecot SQL authentication bypass authentication + user enumeration This repository contains a proof-of-concept authentication-bypass exploit for CVE-2026-24031 , a SQL injection in Dovecot's SQL-based authentication introduced as a regression in Dovecot 2.4.0 / 3.1.0. In the test...

Astra Linux – Vulnerability in dovecot

The ManageSieve AUTHENTICATE command crashes when using “literal” as the initial response to SASL. This can be used to repeatedly crash the ManageSieve service, rendering it unavailable to other users. It’s recommended to control access to the ManageSieve port or disable the service if it’s not...

MiracleLinux 9 : dovecot-2.3.16-18.el9_8.8 (AXSA:2026-2051:08)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2051:08 advisory. dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters CVE-2026-42391 dovecot: Dovecot: Authentication bypass via incorre...

RLSA-2026:80825 Important: dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fixes: doveco...

dovecot security update

An update is available for dovecot. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Dovecot is an IMAP server for Linux and other UNIX-like systems, written...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: dovecot (UTSA-2026-130073)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130073 advisory. An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: dovecot (UTSA-2026-130077)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130077 advisory. When mailmaxuseripconnections is set default 10 and reached, submission-login can crash with epoll panic caused by file descriptor handling issues. If running in...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: dovecot (UTSA-2026-130080)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130080 advisory. None None None No publicly available exploits are known. Tenable has extracted the preceding description block directly from the Unity Linux security advisory. Note...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: dovecot (UTSA-2026-130078)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130078 advisory. An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: dovecot (UTSA-2026-130079)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130079 advisory. An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: dovecot (UTSA-2026-130082)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130082 advisory. An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: dovecot (UTSA-2026-130075)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130075 advisory. An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory...

MiracleLinux 8 : dovecot-2.3.16-16.el8_10 (AXSA:2026-2032:07)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2032:07 advisory. dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters CVE-2026-42391 dovecot: Dovecot: Authentication bypass via incorre...

dovecot: Dovecot: MySQL multi-byte escaping wrong

A flaw was found in Dovecot. A remote attacker with high attack complexity could exploit this vulnerability to gain access to sensitive information and modify data without requiring any user interaction or privileges...

dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free

A flaw was found in Dovecot. An authenticated attacker can use a Sieve script with the editheader extension to trigger a use-after-free vulnerability in the mail editing code. This can lead to memory corruption, potentially crashing the mail delivery process and allowing for arbitrary code...

dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters

A flaw was found in Dovecot. An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in. This action causes the server to consume excessive memory and CPU resources, leading to the termination of login processes and other active connections...

dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation

A flaw was found in Dovecot. This vulnerability allows an attacker to bypass authentication by exploiting how OAuth2 tokens are validated. If an OAuth2 token response does not include a scope claim, Dovecot incorrectly uses the audience claim in its place for authorization checks. This can lead t...

dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve

A flaw was found in Dovecot's ManageSieve login process. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted, truncated quoted argument. This action causes the process to enter an infinite loop, consuming excessive CPU resources. Repeated exploitation can lea...

dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion

A flaw was found in the Dovecot mail server's submission-login component. This vulnerability occurs when the server reaches its maximum allowed user IP connections, leading to a crash due to file descriptor handling issues. This can result in a denial of service, preventing users from sending...