CVE-2020-7957
The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when...
CVE-2020-7957 is a low vulnerability (CVSS 3.1) in Dovecot, published February 12, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.88%, the 79th percentile. Fixed in dovecot 2.3.10.1-r0.
The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the snippet and a trailing > character exists. This causes a denial of service in which the recipient cannot read all of their messages.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the snippet and a trailing > character exists. This causes a denial of service in which the recipient cannot read all of their messages.
- Record
CVE-2020-7957- CVSS 3.0
- 3.1 Low
CVSS:3.0/AC:H/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:R - Updated
- 2026-11-02
EUVDEUVD-2020-28877
The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the snippet and a trailing > character exists. This causes a denial of service in which the recipient cannot read all of their messages.
- Record
EUVD-2020-28877- CVSS 3.0
- 3.1 Low
CVSS:3.0/AC:H/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:R - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vg8f-j3m8-7g9v No score
The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when...
The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the snippet and a trailing > character exists. This causes a denial of service in which the recipient cannot read all of their messages.
- Record
GHSA-vg8f-j3m8-7g9v- Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the snippet and a trailing > character exists. This causes a denial of service in which the recipient cannot read all of their messages.
- Record
CVE-2020-7957- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.0
- 3.1 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVALPINE-CVE-2020-7957
The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the snippet and a trailing > character exists. This causes a denial of service in which the recipient cannot read all of their messages.
- Record
ALPINE-CVE-2020-7957- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSV
The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the snippet and a trailing > character exists. This causes a denial of service in which the recipient cannot read all of their messages.
- Record
CVE-2020-7957- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10726-1 No score
dovecot23-2.3.16-1.6 on GA media
These are all security issues fixed in the dovecot23-2.3.16-1.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10726-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14715-1 No score
dovecot24-2.4.0-1.1 on GA media
These are all security issues fixed in the dovecot24-2.4.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14715-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dovecotAlpine:v3.10 |
2.3.9 up to 2.3.10.1-r0 | 2.3.10.1-r0 |
dovecotAlpine:v3.11 |
2.3.9 up to 2.3.9.3-r0 | 2.3.9.3-r0 |
dovecotAlpine:v3.12 |
2.3.9 up to 2.3.9.3-r0 | 2.3.9.3-r0 |
dovecotAlpine:v3.13 |
2.3.9 up to 2.3.9.3-r0 | 2.3.9.3-r0 |
dovecotAlpine:v3.14 |
2.3.9 up to 2.3.9.3-r0 | 2.3.9.3-r0 |
dovecotAlpine:v3.15 |
2.3.9 up to 2.3.9.3-r0 | 2.3.9.3-r0 |
dovecotAlpine:v3.16 |
2.3.9 up to 2.3.9.3-r0 | 2.3.9.3-r0 |
dovecotAlpine:v3.17 |
2.3.9 up to 2.3.9.3-r0 | 2.3.9.3-r0 |
dovecotAlpine:v3.18 |
2.3.9 up to 2.3.9.3-r0 | 2.3.9.3-r0 |
dovecotAlpine:v3.19 |
2.3.9 up to 2.3.9.3-r0 | 2.3.9.3-r0 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
dovecotAlpine:v3.20 |
2.3.9 up to 2.3.9.3-r0 | 2.3.9.3-r0 |
dovecotAlpine:v3.21 |
2.3.9 up to 2.3.9.3-r0 | 2.3.9.3-r0 |
dovecotAlpine:v3.22 |
2.3.9 up to 2.3.9.3-r0 | 2.3.9.3-r0 |
dovecotAlpine:v3.23 |
2.3.9 up to 2.3.9.3-r0 | 2.3.9.3-r0 |
dovecotAlpine:v3.24 |
2.3.9 up to 2.3.9.3-r0 | 2.3.9.3-r0 |
dovecotAlpine:v3.8 |
2.3.9 up to 2.3.10.1-r0 | 2.3.10.1-r0 |
dovecotAlpine:v3.9 |
2.3.9 up to 2.3.10.1-r0 | 2.3.10.1-r0 |
dovecot23openSUSE:Tumbleweed |
before 2.3.16-1.6 | 2.3.16-1.6 |
dovecot24openSUSE:Tumbleweed |
before 2.4.0-1.1 | 2.4.0-1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
dovecot.org/security
openwall.com/lists/oss-security/2020/02/12/2
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XYT55WH372BJOXCJRKBDIFGBMPVOIDT
nvd.nist.gov/vuln/detail/CVE-2020-7957
Show 29 moreShow less
github.com/advisories/GHSA-vg8f-j3m8-7g9v
security.alpinelinux.org/vuln/CVE-2020-7957
suse.com/security/cve/CVE-2017-14461
lists.opensuse.org/archives/list/[email protected]/thread/KZSDCZ5LA6IHY7KXVSL6ULAJVP6OFT2M