CVE-2026-33603

Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to position itself between Dovecot and the client connection. If successful, the attacker can eavesdrop communications between Dovecot and...

CLSA-2026-1778573628 dovecot: Fix of 2 CVEs

CVE-2026-27855: use translated username in authcacheremove to prevent OTP authentication replay attack - CVE-2026-27856: use timing-safe credential comparison in doveadm HTTP and TCP authentication paths...

PT-2026-40028

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.4-1.1 Description An attacker can use the IMAP SETACL command to inject the anyone permission into a user's dovecot-acl file, bypassing the imap acl allow anyone=no configuration. This allows folders to be spammed...

Open-Xchange OX Dovecot Pro 访问控制错误漏洞

Open-Xchange OX Dovecot Pro is an email storage and delivery system provided by the German company Open-Xchange. Open-Xchange OX Dovecot Pro has a access control vulnerability. This vulnerability stems from the IMAP SETACL command, which allows the anyone permission to be injected into the user’s...

Open-Xchange OX Dovecot Pro 安全漏洞

Open-Xchange OX Dovecot Pro is a mail storage and delivery system provided by the German company Open-Xchange. Open-Xchange OX Dovecot Pro has a security vulnerability. This vulnerability arises from the possibility for attackers to use specially crafted Base64-encoded exchanges to forge SCRAM TL...

Open-Xchange OX Dovecot Pro 安全漏洞

Open-Xchange OX Dovecot Pro is a mail storage and delivery system provided by the German company Open-Xchange. Open-Xchange OX Dovecot Pro has a security vulnerability. This vulnerability arises from the use of a security filter for variable expansion, where all subsequent pipes on the same strin...

Open-Xchange OX Dovecot Pro 资源管理错误漏洞

Open-Xchange OX Dovecot Pro is an email storage and delivery system provided by the German company Open-Xchange. Open-Xchange OX Dovecot Pro has a resource management vulnerability. This vulnerability stems from allowing attackers to upload malicious Sieve scripts, bypassing the configured CPU ti...

PT-2026-40025

Name of the Vulnerable Software and Affected Versions Dovecot versions prior to 2.4.4-1.1 Description An attacker positioned between Dovecot and the client connection can use a specially crafted base64 exchange to fake SCRAM TLS channel binding. This allows the attacker to act as a MITM...

Open-Xchange OX Dovecot Pro 资源管理错误漏洞

Open-Xchange OX Dovecot Pro is an email storage and delivery system provided by the German company Open-Xchange. Open-Xchange OX Dovecot Pro has a resource management vulnerability, which stems from excessive use of curly braces in IMAP, leading to uncontrolled memory usage. This can result in...

CLSA-2026-1778278274 dovecot: Fix of 2 CVEs

CVE-2026-27858: managesieve: fix DoS via crafted message before authentication that caused excessive memory allocation - CVE-2025-59032: managesieve: fix crash when AUTHENTICATE command does not finish on the first call literal SASL initial response...

CLSA-2026-1778255734 dovecot: Fix of 2 CVEs

CVE-2026-27858: bound managesieve-login AUTHENTICATE initial response size to prevent memory exhaustion DoS before authentication - CVE-2025-59032: fix managesieve-login crash when AUTHENTICATE command did not finish on the first call due to literal SASL initial response...

CLSA-2026-1778250885 dovecot: Fix of CVE-2026-27857

CVE-2026-27857: imap-login: limit IMAP parser open lists to prevent excessive memory usage...

CLSA-2026-1778238067 dovecot: Fix of CVE-2026-27857

CVE-2026-27857: fix excessive memory usage from many '' in IMAP commands...

CLSA-2026-1778220630 dovecot: Fix of 3 CVEs

CVE-2026-27855: fix OTP authentication replay attack via auth cache - CVE-2026-27856: fix doveadm credential timing oracle - CVE-2026-27857: fix excessive memory usage from deeply nested IMAP command lists pre-auth ID command...

MiracleLinux 9 : dovecot-2.3.16-15.el9_7.1 (AXSA:2026-567:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-567:01 advisory. dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command CVE-2025-59032 dovecot: denial of service via craft...

CLSA-2026-1778173027 dovecot: Fix of CVE-2026-27858

CVE-2026-27858: fix unbounded memory allocation in managesieve-login when AUTHENTICATE initial response literal size is excessively large...

CLSA-2026-1778172123 dovecot: Fix of CVE-2026-27858

CVE-2026-27858: fix unbounded memory allocation in managesieve-login when AUTHENTICATE initial response literal size is excessively large...

dovecot security update

An update is available for dovecot. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Dovecot is an IMAP server for Linux and other UNIX-like systems, written...

RLSA-2026:13857 Important: dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fixes: doveco...

dovecot security update

An update is available for dovecot. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Dovecot is an IMAP server for Linux and other UNIX-like systems, written...