CLSA-2026-1792764393 dovecot: Fix of CVE-2026-42007

CVE-2026-42007: deliver the bundled pigeonhole edit-mail fix with direct regressions for no-snapshot deletion and header replacement...

CLSA-2026-1792764227 dovecot: Fix of CVE-2026-42007

CVE-2026-42007: deliver the bundled pigeonhole edit-mail fix with direct regressions for no-snapshot deletion and header replacement...

CLSA-2026-1792753365 dovecot: Fix of CVE-2026-42007

CVE-2026-42007: fix use-after-free and NUL-truncated header info leak in bundled pigeonhole edit-mail...

CLSA-2026-1792753135 dovecot: Fix of CVE-2026-42007

CVE-2026-42007: fix use-after-free and NUL-truncated header info leak in bundled pigeonhole edit-mail...

CLSA-2026-1792596933 dovecot: Fix of CVE-2026-42007

CVE-2026-42007: pigeonhole: sieve editheader: reset header-index first pointers before rebuilding the index and copy raw header data with memcpy instead of istrndup...

dovecot security update

1:2.3.16-18.8 - fix CVE-2026-33605: ManageSieve protocol denial of service via lone CR character RHEL-251989 1:2.3.16-18.7 - fix CVE-2026-42007: use-after-free in pigeonhole editheader RHEL-251952 1:2.3.16-18.6 - fix CVE-2026-40018: incorrect escaping of multi-byte strings in SQL commands...

UBUNTU-CVE-2026-40013

An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script. This causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of...

CVE-2026-40013

An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script. This causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of...

CLSA-2026-1786675596 Fix CVE(s): CVE-2026-27858

SECURITY UPDATE: managesieve-login pre-auth excessive memory usage DoS via oversized AUTHENTICATE initial response ELSCVE-158960 - debian/patches/CVE-2026-27858.patch: verify the AUTHENTICATE initial response size is not too large before allocating in...

CLSA-2026-1786619512 Fix CVE(s): CVE-2026-27858

SECURITY UPDATE: managesieve-login pre-auth excessive memory usage DoS via oversized AUTHENTICATE initial response ELSCVE-158958 - debian/patches/CVE-2026-27858.patch: verify the AUTHENTICATE initial response size is not too large before allocating in...

CLSA-2026-1785836865 Fix CVE(s): CVE-2026-27858

SECURITY UPDATE: managesieve-login pre-auth excessive memory usage DoS via oversized AUTHENTICATE initial response ELSCVE-158963 - debian/patches/CVE-2026-27858.patch: verify the AUTHENTICATE initial response size is not too large before allocating in...

Security update for dovecot22

This update for dovecot22 fixes the following issues: CVE-2025-59031: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing bsc1260895. CVE-2025-59032: pigeonhole: ManageSieve panic occurs with sieve-connect as a client bsc1260902. CVE-2026-27855: OTP drive...

SUSE-SU-2026:1641-1 Security update for dovecot22

This update for dovecot22 fixes the following issues: - CVE-2025-59031: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing bsc1260895. - CVE-2025-59032: pigeonhole: ManageSieve panic occurs with sieve-connect as a client bsc1260902. - CVE-2026-27855: OTP...

SUSE-SU-2026:21208-1 Security update for dovecot24

This update for dovecot24 fixes the following issues: - Update to v2.4.3 - CVE-2025-59028: Invalid base64 authentication can cause DoS for other logins bsc1260894. - CVE-2025-59031: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing bsc1260895. -...

CVE-2025-59032

ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed...

Towards Anonymous Neural Network Inference

We introduce funion, a system providing end-to-end sender-receiver unlinkability for neural network inference. By leveraging the Pigeonhole storage protocol and BACAP blinding-and-capability scheme from the Echomix anonymity system, funion inherits the provable security guarantees of modern...

SUSE CVE-2019-11500

In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 and Pigeonhole before 0.5.7.2, protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution...

FreeBSD : dovecot-pigeonhole -- Sieve excessive resource usage (f3fc2b50-d36a-11eb-a32c-00a0989e4ec1)

Dovecot team reports reports : Sieve interpreter is not protected against abusive scripts that claim excessive resource usage. Fixed by limiting the user CPU time per single script execution and cumulatively over several script runs within a configurable timeout period. Sufficiently large CPU tim...

[ASA-202106-57] pigeonhole: denial of service

Arch Linux Security Advisory ASA-202106-57 ========================================== Severity: Medium Date : 2021-06-22 CVE-ID : CVE-2020-28200 Package : pigeonhole Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2088 Summary ======= The package pigeonhole before...

SUSE: Security Advisory (SUSE-SU-2019:0414-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...