CVE-2020-7046

lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8...

7.5 HighFix available

CVE-2020-7046 is a high vulnerability (CVSS 7.5) in Dovecot, published February 12, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 51.3%, the 98th percentile. Fixed in dovecot 2.3.10.1-r0.

lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

51.3%Up 50.0 points since Apr 14, 2021

What each source reports

CVE List Score used 7.5

Record: CVE-2020-7046
CVSS 3.0: 7.5 HighCVSS:3.0/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N
Updated: 2026-11-02

EUVDEUVD-2020-28180 7.5

Record: EUVD-2020-28180
CVSS 3.0: 7.5 HighCVSS:3.0/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xxqf-cf9x-9rwq No score

lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8...

Record: GHSA-xxqf-cf9x-9rwq
Weakness: CWE-835
Updated: 2026-11-02

NVD 7.5

Record: CVE-2020-7046
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 7.8 HighAV:N/AC:L/Au:N/C:N/I:N/A:C
Weakness: CWE-835
Updated: 2026-11-02

OSVALPINE-CVE-2020-7046 7.5

Record: ALPINE-CVE-2020-7046
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 7.5

Record: CVE-2020-7046
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10726-1 No score

dovecot23-2.3.16-1.6 on GA media

These are all security issues fixed in the dovecot23-2.3.16-1.6 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10726-1
Updated: 2026-11-02

OSVopenSUSE-SU-2025:14715-1 No score

dovecot24-2.4.0-1.1 on GA media

These are all security issues fixed in the dovecot24-2.4.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2025:14715-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`dovecot` Alpine:v3.10	2.3.9 up to 2.3.10.1-r0	2.3.10.1-r0
`dovecot` Alpine:v3.11	2.3.9 up to 2.3.9.3-r0	2.3.9.3-r0
`dovecot` Alpine:v3.12	2.3.9 up to 2.3.9.3-r0	2.3.9.3-r0
`dovecot` Alpine:v3.13	2.3.9 up to 2.3.9.3-r0	2.3.9.3-r0
`dovecot` Alpine:v3.14	2.3.9 up to 2.3.9.3-r0	2.3.9.3-r0
`dovecot` Alpine:v3.15	2.3.9 up to 2.3.9.3-r0	2.3.9.3-r0
`dovecot` Alpine:v3.16	2.3.9 up to 2.3.9.3-r0	2.3.9.3-r0
`dovecot` Alpine:v3.17	2.3.9 up to 2.3.9.3-r0	2.3.9.3-r0
`dovecot` Alpine:v3.18	2.3.9 up to 2.3.9.3-r0	2.3.9.3-r0
`dovecot` Alpine:v3.19	2.3.9 up to 2.3.9.3-r0	2.3.9.3-r0

Show 9 moreShow less

Affected packages
Package	Affected	Fixed
`dovecot` Alpine:v3.20	2.3.9 up to 2.3.9.3-r0	2.3.9.3-r0
`dovecot` Alpine:v3.21	2.3.9 up to 2.3.9.3-r0	2.3.9.3-r0
`dovecot` Alpine:v3.22	2.3.9 up to 2.3.9.3-r0	2.3.9.3-r0
`dovecot` Alpine:v3.23	2.3.9 up to 2.3.9.3-r0	2.3.9.3-r0
`dovecot` Alpine:v3.24	2.3.9 up to 2.3.9.3-r0	2.3.9.3-r0
`dovecot` Alpine:v3.8	2.3.9 up to 2.3.10.1-r0	2.3.10.1-r0
`dovecot` Alpine:v3.9	2.3.9 up to 2.3.10.1-r0	2.3.10.1-r0
`dovecot23` openSUSE:Tumbleweed	before 2.3.16-1.6	2.3.16-1.6
`dovecot24` openSUSE:Tumbleweed	before 2.4.0-1.1	2.4.0-1.1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 29 moreShow less