CLSA-2026-1780910915 dovecot: Fix of 3 CVEs

CVE-2026-40020: imap-acl: reject CR/LF/control-char and non-UTF-8 injection in SETACL identifier - CVE-2026-42006: lib-imap: fix listcountlimit to actually bound '' incomplete fix for CVE-2026-27857 - CVE-2026-40016: lib-sieve: enforce sievemaxcputime inside :contains/:matches matcher loops...

dovecot: Fix of 2 CVEs

CVE-2026-42006: lib-imap: fix listcountlimit to actually count open '' instead of close '', preventing an imap-login memory-exhaustion DoS that bypassed the CVE-2026-27857 fix...

CLSA-2026-1779371000 dovecot: Fix of 2 CVEs

CVE-2026-42006: lib-imap: fix listcountlimit to actually count open '' instead of close '', preventing an imap-login memory-exhaustion DoS that bypassed the CVE-2026-27857 fix...