dovecot: Dovecot: Denial of Service via excessive IMAP bracing

A flaw was found in Dovecot. A remote attacker can exploit this vulnerability by sending excessive open braces over the Internet Message Access Protocol IMAP, leading to uncontrolled memory usage. This can cause the affected system to consume memory up to its configured limit, resulting in a Deni...

Important: Red Hat Security Advisory: dovecot security update

An update for dovecot is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

RHEL 10 : dovecot (RHSA-2026:42091)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:42091 advisory. Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and...

TencentOS Server 3: ruby:3.3 (TSSA-2026:0657)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0657 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Oracle Linux 10 : dovecot (ELSA-2026-41988)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-41988 advisory. 1:2.3.21-19.1 - fix CVE-2026-42006: fix imapparser listcountlimit to actually work RHEL-188477 Tenable has extracted the preceding description block directly...

dovecot security update

1:2.3.21-19.1 - fix CVE-2026-42006: fix imapparser listcountlimit to actually work RHEL-188477...

ALSA-2026:41988 Important: dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fixes: doveco...

Oracle Linux 10 : ruby4.0 (ELSA-2026-20606)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-20606 advisory. - Fix Net::IMAP ResponseReader quadratic complexity vulnerability CVE-2026-42245 Includes core fix plus additional performance optimizations Resolves...

Linux Distros Unpatched Vulnerability : CVE-2026-47086

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token...

SUSE SLED15: libruby3_4-3_4 / ruby3.4 / ruby3.4-devel / ruby3.4-devel-extra / etc (SUSE-SU-2026:3090-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3090-1 advisory. This update for ruby3.4 fixes the following issues - CVE-2026-42258: Net:IMAP: Command Injection via Symbol...

SUSE CVE-2026-47086

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token via the GENURLAUTH command for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes...

SUSE CVE-2026-47089

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. This action should have been restricted ...

Security update for ruby3.4

This update for ruby3.4 fixes the following issues CVE-2026-42258: Net:IMAP: Command Injection via Symbol Arguments bsc1268011. CVE-2026-47240: Net:IMAP: Command Injection via non-synchronizing literal in "raw" argument bsc1268337. CVE-2026-47241: Net:IMAP: Denial of Service via incomplete raw...

SUSE-SU-2026:3090-1 Security update for ruby3.4

This update for ruby3.4 fixes the following issues - CVE-2026-42258: Net:IMAP: Command Injection via Symbol Arguments bsc1268011. - CVE-2026-47240: Net:IMAP: Command Injection via non-synchronizing literal in 'raw' argument bsc1268337. - CVE-2026-47241: Net:IMAP: Denial of Service via incomplete...

CVE-2026-47084

A flaw was found in Cyrus IMAP cyrus-imapd. An authenticated user, without administrative privileges, could bypass Access Control List ACL checks by using the LOCALDELETE command. This allowed them to delete mailboxes for which they did not have the necessary permissions, leading to unauthorized...

CVE-2026-47082

A flaw was found in Cyrus IMAP's cyrus-imapd component. A user with low privileges can exploit a vulnerability in the vacation "fcc" feature. By crafting a specific Sieve script, the user can bypass access control lists and deliver vacation auto-reply messages into any mailbox, leading to...

CVE-2026-47085

A flaw was found in Cyrus IMAP cyrus-imapd. A remote attacker could exploit a vulnerability related to URLAUTH token forgery, caused by a missing mailbox key. This could allow the attacker to gain unauthorized read access to a victim's mailbox. The likelihood of exploitation is low due to the...

CVE-2026-47088

A flaw was found in Cyrus IMAP Internet Message Access Protocol daemon, cyrus-imapd. An authenticated IMAP user could exploit a heap exposure vulnerability during nested Multipurpose Internet Mail Extensions MIME comment parsing. By crafting an email message with a specially formed RFC 822 commen...

Oracle Linux 10 : ruby4.0 (ELSA-2026-33540)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-33540 advisory. - Fix Net::IMAP ResponseReader quadratic complexity vulnerability CVE-2026-42245 Includes core fix plus additional performance optimizations Resolves...

Linux Distros Unpatched Vulnerability : CVE-2026-47088

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could cra...