Every CVE Search/ Get API key

CVE-2026-24031

Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin....

7.7 HighPublic exploitFix available

Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
Low

Exploit likelihood

0.40%Up 0.3 points since Mar 27, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.7

Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.

Record
CVE-2026-24031
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Weakness
CWE-89, CWE-89
Updated
2026-11-02
EUVDEUVD-2026-16561 7.7

Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.

Record
EUVD-2026-16561
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-fx6f-5qgf-9fmx 7.7

Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin....

Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.

Record
GHSA-fx6f-5qgf-9fmx
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Weakness
CWE-89
Updated
2026-11-02
NVD 7.7

Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.

Record
CVE-2026-24031
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Weakness
CWE-89
Updated
2026-11-02
OSVALPINE-CVE-2026-24031 8.2

Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.

Record
ALPINE-CVE-2026-24031
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSV 7.7

Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.

Record
CVE-2026-24031
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Weakness
CWE-89
Updated
2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2026-24031 8.2

Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.

Record
DEBIAN-CVE-2026-24031
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-24031 7.7

Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.

Record
UBUNTU-CVE-2026-24031
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVAZL-81698 No score

CVE-2026-24031 affecting package dovecot 2.3.20-1

Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.

Record
AZL-81698
Updated
2026-11-05
OSVopenSUSE-SU-2026:10442-1 No score

dovecot24-2.4.3-1.1 on GA media

These are all security issues fixed in the dovecot24-2.4.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10442-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20554-1 No score

Security update for dovecot24

This update for dovecot24 fixes the following issues:

  • Update to v2.4.3
  • CVE-2025-59028: Invalid base64 authentication can cause DoS for other logins (bsc#1260894).
  • CVE-2025-59031: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing (bsc#1260895).
  • CVE-2025-59032: pigeonhole: ManageSieve panic occurs with sieve-connect as a client (bsc#1260902).
  • CVE-2026-24031: SQL injection possible if auth_username_chars is configured empty. Fixed escaping to always happen. v2.4 regression (bsc#1260896).
  • CVE-2026-27855: OTP driver vulnerable to replay attack (bsc#1260900).
  • CVE-2026-27856: Doveadm credentials were not checked using timing-safe checking function (bsc#1260899).
  • CVE-2026-27857: sending excessive parenthesis causes imap-login to use excessive memory (bsc#1260898).
  • CVE-2026-27858: pigeonhole: managesieve-login can allocate large amount of memory during authentication (bsc#1260901).
  • CVE-2026-27859: excessive RFC 2231 MIME parameters in email would can excessive CPU usage (bsc#1260897).
  • CVE-2026-27860: LDAP query injection possible if auth_username_chars is configured empty. Fixed escaping to always happen. v2.4 regression (bsc#1260893).
Record
openSUSE-SU-2026:20554-1
Updated
2026-11-02
OSVSUSE-SU-2026:21208-1 No score

Security update for dovecot24

This update for dovecot24 fixes the following issues:

  • Update to v2.4.3
  • CVE-2025-59028: Invalid base64 authentication can cause DoS for other logins (bsc#1260894).
  • CVE-2025-59031: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing (bsc#1260895).
  • CVE-2025-59032: pigeonhole: ManageSieve panic occurs with sieve-connect as a client (bsc#1260902).
  • CVE-2026-24031: SQL injection possible if auth_username_chars is configured empty. Fixed escaping to always happen. v2.4 regression (bsc#1260896).
  • CVE-2026-27855: OTP driver vulnerable to replay attack (bsc#1260900).
  • CVE-2026-27856: Doveadm credentials were not checked using timing-safe checking function (bsc#1260899).
  • CVE-2026-27857: sending excessive parenthesis causes imap-login to use excessive memory (bsc#1260898).
  • CVE-2026-27858: pigeonhole: managesieve-login can allocate large amount of memory during authentication (bsc#1260901).
  • CVE-2026-27859: excessive RFC 2231 MIME parameters in email would can excessive CPU usage (bsc#1260897).
  • CVE-2026-27860: LDAP query injection possible if auth_username_chars is configured empty. Fixed escaping to always happen. v2.4 regression (bsc#1260893).
Record
SUSE-SU-2026:21208-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dovecot
Alpine:v3.23
 before 2.4.3-r0
2.4.3-r0
dovecot
Alpine:v3.24
 before 2.4.3-r0
2.4.3-r0
dovecot
Azure Linux:3
 through 2.3.20-1 None known
dovecot
Debian:13
 before 1:2.4.1+dfsg1-6+deb13u4, plus listed versions
1:2.4.1+dfsg1-61:2.4.1+dfsg1-6+deb13u11:2.4.1+dfsg1-6+deb13u21:2.4.1+dfsg1-6+deb13u3
1:2.4.1+dfsg1-6+deb13u4
dovecot
Debian:14
 before 1:2.4.3+dfsg1-1, plus listed versions
1:2.4.1+dfsg1-61:2.4.1+dfsg1-71:2.4.1+dfsg1-81:2.4.1+dfsg1-91:2.4.2+dfsg1-11:2.4.2+dfsg1-21:2.4.2+dfsg1-31:2.4.2+dfsg1-4
1:2.4.3+dfsg1-1
dovecot24
SUSE:Linux Enterprise Server 16.0
From an advisory covering 10 CVEs
 before 2.4.3-160000.1.1
2.4.3-160000.1.1
dovecot24
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 10 CVEs
 before 2.4.3-160000.1.1
2.4.3-160000.1.1
dovecot
Ubuntu:25.10
 before 1:2.4.1+dfsg1-5ubuntu4.1, plus listed versions
1:2.3.21.1+dfsg1-1ubuntu21:2.4.1+dfsg1-5ubuntu11:2.4.1+dfsg1-5ubuntu31:2.4.1+dfsg1-5ubuntu4
1:2.4.1+dfsg1-5ubuntu4.1
dovecot24
openSUSE:Tumbleweed
From an advisory covering 10 CVEs
 before 2.4.3-1.1
2.4.3-1.1
dovecot24
openSUSE:Leap 16.0
From an advisory covering 10 CVEs
 before 2.4.3-160000.1.1
2.4.3-160000.1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubaramosf/CVE-2026-240312026-08-12

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-24031 is a high vulnerability (CVSS 7.7) in Dovecot, published March 27, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in dovecot 2.4.3-r0.

References

Show 27 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open