Every CVE Search/ Get API key

CVE-2026-27851

When safe filter is used with variable expansion, all following pipelines on the same string are...

7.4 HighFix available

When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.41%Up 0.4 points since May 13, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.4

When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.

Record
CVE-2026-27851
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-235, CWE-89
Updated
2026-11-02
EUVDEUVD-2026-29467 7.4

When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.

Record
EUVD-2026-29467
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-xfpv-rrgm-4qqr 7.4

When safe filter is used with variable expansion, all following pipelines on the same string are...

When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.

Record
GHSA-xfpv-rrgm-4qqr
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-89, CWE-235
Updated
2026-11-02
NVD 7.4

When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.

Record
CVE-2026-27851
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-235, CWE-89
Updated
2026-11-02
OSVALPINE-CVE-2026-27851 9.1

When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.

Record
ALPINE-CVE-2026-27851
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSV 7.4

When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.

Record
CVE-2026-27851
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-235
Updated
2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2026-27851 9.1

When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.

Record
DEBIAN-CVE-2026-27851
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-27851 7.4

When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.

Record
UBUNTU-CVE-2026-27851
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVAZL-86799 No score

CVE-2026-27851 affecting package dovecot 2.3.20-1

When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.

Record
AZL-86799
Updated
2026-11-05
OSVopenSUSE-SU-2026:10766-1 No score

dovecot24-2.4.4-1.1 on GA media

These are all security issues fixed in the dovecot24-2.4.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10766-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21109-1 No score

Security update for dovecot24

This update for dovecot24 fixes the following issues

  • CVE-2026-27851: lib-var-expand: safe filter leaks to all following pipelines (bsc#1265146).
  • CVE-2026-33603: login: base64 input can contain tabs that bypass IPC protection (bsc#1265147).
  • CVE-2026-40016: Sieve: contains/: matches O(NxM) substring match bypasses sieve_max_cpu_time limit (bsc#1265148).
  • CVE-2026-40020: IMAP folders can be shared-spammed to everyone (bsc#1265149).
  • CVE-2026-42006: imap-login: uncontrolled memory usage with excessive bracing over IMAP (bsc#1265150).

Changes for dovecot24:

  • Update to 2.4.4
Record
openSUSE-SU-2026:21109-1
Updated
2026-11-02
OSVSUSE-SU-2026:22185-1 No score

Security update for dovecot24

This update for dovecot24 fixes the following issues

  • CVE-2026-27851: lib-var-expand: safe filter leaks to all following pipelines (bsc#1265146).
  • CVE-2026-33603: login: base64 input can contain tabs that bypass IPC protection (bsc#1265147).
  • CVE-2026-40016: Sieve: contains/: matches O(NxM) substring match bypasses sieve_max_cpu_time limit (bsc#1265148).
  • CVE-2026-40020: IMAP folders can be shared-spammed to everyone (bsc#1265149).
  • CVE-2026-42006: imap-login: uncontrolled memory usage with excessive bracing over IMAP (bsc#1265150).

Changes for dovecot24:

  • Update to 2.4.4
Record
SUSE-SU-2026:22185-1
Updated
2026-11-02
OSVUSN-8365-1 No score

dovecot vulnerabilities

It was discovered that Dovecot incorrectly treated some variable expansion pipelines as safe in authentication filters. An attacker could possibly use this issue to perform SQL or LDAP injection attacks. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-27851)

It was discovered that Dovecot incorrectly verified SCRAM TLS channel binding in certain base64 exchanges. A remote attacker could possibly use this issue to obtain sensitive information in a machine-in-the-middle attack. (CVE-2026-33603)

It was discovered that Dovecot incorrectly enforced Sieve script CPU limits. An attacker could possibly use this issue to cause Dovecot to use excessive resources, leading to a denial of service. (CVE-2026-40016)

It was discovered that Dovecot incorrectly handled certain IMAP SETACL commands. An attacker could possibly use this issue to spam folders to other users. (CVE-2026-40020)

It was discovered that Dovecot incorrectly handled excessive IMAP bracing. An attacker could possibly use this issue to cause Dovecot to use excessive resources, leading to a denial of service. (CVE-2026-42006)

Record
USN-8365-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dovecot
Alpine:v3.23
 before 2.4.4-r0
2.4.4-r0
dovecot
Alpine:v3.24
 before 2.4.4-r0
2.4.4-r0
dovecot
Azure Linux:3
 through 2.3.20-1 None known
dovecot
Debian:13
 before 1:2.4.1+dfsg1-6+deb13u6, plus listed versions
1:2.4.1+dfsg1-61:2.4.1+dfsg1-6+deb13u11:2.4.1+dfsg1-6+deb13u21:2.4.1+dfsg1-6+deb13u31:2.4.1+dfsg1-6+deb13u41:2.4.1+dfsg1-6+deb13u5
1:2.4.1+dfsg1-6+deb13u6
dovecot
Debian:14
 before 1:2.4.4+dfsg1-1, plus listed versions
1:2.4.1+dfsg1-61:2.4.1+dfsg1-71:2.4.1+dfsg1-81:2.4.1+dfsg1-91:2.4.2+dfsg1-1
Show 5 moreShow less
1:2.4.2+dfsg1-21:2.4.2+dfsg1-31:2.4.2+dfsg1-41:2.4.3+dfsg1-11:2.4.3+dfsg1-2
1:2.4.4+dfsg1-1
dovecot24
SUSE:Linux Enterprise Server 16.0
From an advisory covering 5 CVEs
 before 2.4.4-160000.1.1
2.4.4-160000.1.1
dovecot24
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 5 CVEs
 before 2.4.4-160000.1.1
2.4.4-160000.1.1
dovecot
Ubuntu:25.10
 before 1:2.4.1+dfsg1-5ubuntu4.2, plus listed versions
1:2.3.21.1+dfsg1-1ubuntu21:2.4.1+dfsg1-5ubuntu11:2.4.1+dfsg1-5ubuntu31:2.4.1+dfsg1-5ubuntu41:2.4.1+dfsg1-5ubuntu4.1
1:2.4.1+dfsg1-5ubuntu4.2
dovecot
Ubuntu:26.04:LTS
 before 1:2.4.2+dfsg1-3ubuntu2.1, plus listed versions
1:2.4.1+dfsg1-5ubuntu41:2.4.1+dfsg1-5ubuntu51:2.4.2+dfsg1-3ubuntu11:2.4.2+dfsg1-3ubuntu2
1:2.4.2+dfsg1-3ubuntu2.1
dovecot
Ubuntu:22.04:LTS
 before 1:2.3.16+dfsg1-3ubuntu2.9, plus listed versions
1:2.3.13+dfsg1-1ubuntu31:2.3.16+dfsg1-3ubuntu11:2.3.16+dfsg1-3ubuntu21:2.3.16+dfsg1-3ubuntu2.11:2.3.16+dfsg1-3ubuntu2.2
Show 4 moreShow less
1:2.3.16+dfsg1-3ubuntu2.41:2.3.16+dfsg1-3ubuntu2.61:2.3.16+dfsg1-3ubuntu2.71:2.3.16+dfsg1-3ubuntu2.8
1:2.3.16+dfsg1-3ubuntu2.9
dovecot
Ubuntu:24.04:LTS
 before 1:2.3.21+dfsg1-2ubuntu6.5, plus listed versions
1:2.3.20+dfsg1-1ubuntu31:2.3.21+dfsg1-2ubuntu11:2.3.21+dfsg1-2ubuntu21:2.3.21+dfsg1-2ubuntu41:2.3.21+dfsg1-2ubuntu5
Show 5 moreShow less
1:2.3.21+dfsg1-2ubuntu61:2.3.21+dfsg1-2ubuntu6.11:2.3.21+dfsg1-2ubuntu6.21:2.3.21+dfsg1-2ubuntu6.31:2.3.21+dfsg1-2ubuntu6.4
1:2.3.21+dfsg1-2ubuntu6.5
dovecot24
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 2.4.4-1.1
2.4.4-1.1
dovecot24
openSUSE:Leap 16.0
From an advisory covering 5 CVEs
 before 2.4.4-160000.1.1
2.4.4-160000.1.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-27851 is a high vulnerability (CVSS 7.4) in Dovecot, published May 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in dovecot 2.4.4-r0.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open