CVE-2026-40204

None None None No publicly available exploits are known.

3.1 LowFix available

None None None No publicly available exploits are known.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.21%Unchanged since Aug 29, 2026

What each source reports

CVE List Score used 3.1

None None None No publicly available exploits are known.

Record: CVE-2026-40204
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-284
Updated: 2026-11-02

EUVDEUVD-2026-67670 3.1

None None None No publicly available exploits are known.

Record: EUVD-2026-67670
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-wxgx-37c3-39ph 3.1

None None None No publicly available exploits are known.

None None None No publicly available exploits are known.

Record: GHSA-wxgx-37c3-39ph
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-284
Updated: 2026-11-02

NVD 3.1

None None None No publicly available exploits are known.

Record: CVE-2026-40204
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-284
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-40204 3.1

None None None No publicly available exploits are known.

Record: DEBIAN-CVE-2026-40204
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-40204 3.1

None None None No publicly available exploits are known.

Record: UBUNTU-CVE-2026-40204
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

Show 4 moreShow less

OSVAZL-98301 No score

CVE-2026-40204 affecting package dovecot 2.3.20-1

None None None No publicly available exploits are known.

Record: AZL-98301
Updated: 2026-11-05

OSVMGASA-2026-0385 No score

Updated dovecot package fixes security vulnerabilities

submission-login: Panic when mail_max_userip_connections is reached: Panic: epoll_ctl(del, 8) failed: Bad file descriptor. (CVE-2026-33263) Dovecot IMAP LIST match_sub() Exponential Backtracking — CPU Denial of Service. (CVE-2026-33607) DoS by sending mail with bad header. (CVE-2026-27852) dsync: Mail content can cause dsync protocol injection. (CVE-2026-33606) SMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return. (CVE-2026-33604) IMAP THREAD REFERENCES O(N²) CPU DoS via Crafted References Header (index-thread-links.c). (CVE-2026-40014) pigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT. (CVE-2026-40013) managesieve-login: Pre-auth crash. (CVE-2026-33605) MySQL multi-byte escaping wrong. (CVE-2026-40018) v2.4.3 regression: managesieve-login pre-auth infinite loop. (CVE-2026-40019) imap-hibernate can be crashed. (CVE-2026-40015) IMAP THREAD O(M³) CPU DoS via CRC32 Hash Collision in strmap (mail-index-strmap.c / hash2.c). (CVE-2026-40017) IMAP Compression Can Reveal Whether a Small Synced Email Body Matches Sender-Chosen Text. (CVE-2026-40203) Sieve editheader RCE. (CVE-2026-42007) acl: lda_mailbox_autocreate can bypass acl restrictions. (CVE-2026-40204) OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path. (CVE-2026-40205) XCLIENT FORWARD= bare token not namespaced, allows nopassword injection via trusted proxy. (CVE-2026-42008) Single NUL-Byte XCLIENT FORWARD Payload Crashes. (CVE-2026-42395) doveadm_password or api key length can still be leaked with timing comparisons. (CVE-2026-42393) Sieve resource usage tracking lost when active script changes. (CVE-2026-52681) imap-urlauth leaks memory into user-visible error messages. (CVE-2026-42392) auth: db-oauth2: aud claim used as fallback for missing scope claim. (CVE-2026-73208) imap-login crash: Self-recursion on zero-output decompress chunks. (CVE-2026-73209) imap: Pre-login memory/CPU growth with ID command. (CVE-2026-42391) IMAP: COMPRESS ZSTD can cause excessive memory usage. (CVE-2026-52687)

Record: MGASA-2026-0385
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21720-1 No score

Security update for dovecot24

This update for dovecot24 fixes the following issues:

Update to 2.4.5.

CVE-2026-33263: submission-login: panic when mail_max_userip_connections is reached (bsc#1276794).
CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799).
CVE-2026-33604: SMTP smuggling via missing dot-stuffing after bare carriage return (bsc#1276802).
CVE-2026-33605: managesieve-login: pre-auth crash (bsc#1276809).
CVE-2026-33606: dsync: mail content can cause dsync protocol injection (bsc#1276800).
CVE-2026-33607: IMAP LIST match_sub() exponential backtracking leading to CPU denial of service (bsc#1276795).
CVE-2026-40013: stack buffer underflow in pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT (bsc#1276807).
CVE-2026-40014: CPU DoS via crafted references header (bsc#1276804).
CVE-2026-40015: imap-hibernate can be crashed (bsc#1276812).
CVE-2026-40017: CPU DoS via CRC32 hash collision in strmap (bsc#1276813).
CVE-2026-40018: MySQL multi-byte escaping performed incorrectly (bsc#1276810).
CVE-2026-40203: IMAP compression can reveal whether a small synced email body matches sender-chosen text (bsc#1276815).
CVE-2026-40204: lda_mailbox_autocreate can bypass ACL restrictions (bsc#1276819).
CVE-2026-40205: OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path (bsc#1276820).
CVE-2026-42007: sieve editheader RCE (bsc#1276817).
CVE-2026-42008: XCLIENT FORWARD= bare token not namespaced (bsc#1276824).
CVE-2026-42391: imap: pre-login memory/CPU growth with ID command (bsc#1276835).
CVE-2026-42392: imap-urlauth leaks memory into user-visible error messages (bsc#1276829).
CVE-2026-42393: doveadm_password or api key length can be leaked with timing comparisons (bsc#1276827).
CVE-2026-52687: imap: COMPRESS ZSTD can cause excessive memory usage (bsc#1276837).
CVE-2026-42395: single NUL-byte XCLIENT FORWARD payload crashes (bsc#1276826).
CVE-2026-52681: sieve resource usage tracking lost when active script changes (bsc#1276828).
CVE-2026-73208: auth: db-oauth2: aud claim used as fallback for missing scope claim (bsc#1276830).
CVE-2026-73209: imap-login crash due to self-recursion on zero-output decompress chunks (bsc#1276833).

Record: openSUSE-SU-2026:21720-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23595-1 No score

Security update for dovecot24

This update for dovecot24 fixes the following issues:

Update to 2.4.5.

CVE-2026-33263: submission-login: panic when mail_max_userip_connections is reached (bsc#1276794).
CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799).
CVE-2026-33604: SMTP smuggling via missing dot-stuffing after bare carriage return (bsc#1276802).
CVE-2026-33605: managesieve-login: pre-auth crash (bsc#1276809).
CVE-2026-33606: dsync: mail content can cause dsync protocol injection (bsc#1276800).
CVE-2026-33607: IMAP LIST match_sub() exponential backtracking leading to CPU denial of service (bsc#1276795).
CVE-2026-40013: stack buffer underflow in pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT (bsc#1276807).
CVE-2026-40014: CPU DoS via crafted references header (bsc#1276804).
CVE-2026-40015: imap-hibernate can be crashed (bsc#1276812).
CVE-2026-40017: CPU DoS via CRC32 hash collision in strmap (bsc#1276813).
CVE-2026-40018: MySQL multi-byte escaping performed incorrectly (bsc#1276810).
CVE-2026-40203: IMAP compression can reveal whether a small synced email body matches sender-chosen text (bsc#1276815).
CVE-2026-40204: lda_mailbox_autocreate can bypass ACL restrictions (bsc#1276819).
CVE-2026-40205: OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path (bsc#1276820).
CVE-2026-42007: sieve editheader RCE (bsc#1276817).
CVE-2026-42008: XCLIENT FORWARD= bare token not namespaced (bsc#1276824).
CVE-2026-42391: imap: pre-login memory/CPU growth with ID command (bsc#1276835).
CVE-2026-42392: imap-urlauth leaks memory into user-visible error messages (bsc#1276829).
CVE-2026-42393: doveadm_password or api key length can be leaked with timing comparisons (bsc#1276827).
CVE-2026-52687: imap: COMPRESS ZSTD can cause excessive memory usage (bsc#1276837).
CVE-2026-42395: single NUL-byte XCLIENT FORWARD payload crashes (bsc#1276826).
CVE-2026-52681: sieve resource usage tracking lost when active script changes (bsc#1276828).
CVE-2026-73208: auth: db-oauth2: aud claim used as fallback for missing scope claim (bsc#1276830).
CVE-2026-73209: imap-login crash due to self-recursion on zero-output decompress chunks (bsc#1276833).

Record: SUSE-SU-2026:23595-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`dovecot` Azure Linux:3	through 2.3.20-1	None known
`dovecot` Debian:12	before 1:2.3.19.1+dfsg1-2.1+deb12u7, plus listed versions 1:2.3.19.1+dfsg1-2.11:2.3.19.1+dfsg1-2.1+deb12u11:2.3.19.1+dfsg1-2.1+deb12u21:2.3.19.1+dfsg1-2.1+deb12u31:2.3.19.1+dfsg1-2.1+deb12u41:2.3.19.1+dfsg1-2.1+deb12u51:2.3.19.1+dfsg1-2.1+deb12u6	1:2.3.19.1+dfsg1-2.1+deb12u7
`dovecot` Debian:13	before 1:2.4.1+dfsg1-6+deb13u7, plus listed versions 1:2.4.1+dfsg1-61:2.4.1+dfsg1-6+deb13u11:2.4.1+dfsg1-6+deb13u21:2.4.1+dfsg1-6+deb13u31:2.4.1+dfsg1-6+deb13u41:2.4.1+dfsg1-6+deb13u51:2.4.1+dfsg1-6+deb13u6	1:2.4.1+dfsg1-6+deb13u7
`dovecot` Debian:14	before 1:2.4.5+dfsg1-1, plus listed versions 1:2.4.1+dfsg1-61:2.4.1+dfsg1-71:2.4.1+dfsg1-81:2.4.1+dfsg1-91:2.4.2+dfsg1-1 Show 7 moreShow less 1:2.4.2+dfsg1-21:2.4.2+dfsg1-31:2.4.2+dfsg1-41:2.4.3+dfsg1-11:2.4.3+dfsg1-21:2.4.4+dfsg1-11:2.4.4+dfsg1-2	1:2.4.5+dfsg1-1
`dovecot` Mageia:10 From an advisory covering 25 CVEs	before 2.4.5-2.mga10	2.4.5-2.mga10
`dovecot24` SUSE:Linux Enterprise Server 16.0 From an advisory covering 24 CVEs	before 2.4.4-160000.2.1	2.4.4-160000.2.1
`dovecot24` SUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 24 CVEs	before 2.4.4-160000.2.1	2.4.4-160000.2.1
`dovecot` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 1:2.1.7-7ubuntu31:2.2.9-1ubuntu11:2.2.9-1ubuntu21:2.2.9-1ubuntu2.11:2.2.9-1ubuntu2.3 Show 7 moreShow less 1:2.2.9-1ubuntu2.41:2.2.9-1ubuntu2.51:2.2.9-1ubuntu2.61:2.2.9-1ubuntu2.6+esm11:2.2.9-1ubuntu2.6+esm21:2.2.9-1ubuntu2.6+esm31:2.2.9-1ubuntu2.6+esm4	None known
`dovecot` Ubuntu:16.04:LTS	All versions, plus listed versions 1:2.2.18-2ubuntu21:2.2.22-1ubuntu11:2.2.22-1ubuntu21:2.2.22-1ubuntu2.11:2.2.22-1ubuntu2.2 Show 11 moreShow less 1:2.2.22-1ubuntu2.31:2.2.22-1ubuntu2.41:2.2.22-1ubuntu2.61:2.2.22-1ubuntu2.71:2.2.22-1ubuntu2.81:2.2.22-1ubuntu2.91:2.2.22-1ubuntu2.101:2.2.22-1ubuntu2.111:2.2.22-1ubuntu2.121:2.2.22-1ubuntu2.131:2.2.22-1ubuntu2.14	None known
`dovecot` Ubuntu:18.04:LTS	All versions, plus listed versions 1:2.2.27-3ubuntu11:2.2.33.2-1ubuntu11:2.2.33.2-1ubuntu21:2.2.33.2-1ubuntu31:2.2.33.2-1ubuntu4 Show 8 moreShow less 1:2.2.33.2-1ubuntu4.11:2.2.33.2-1ubuntu4.21:2.2.33.2-1ubuntu4.31:2.2.33.2-1ubuntu4.41:2.2.33.2-1ubuntu4.51:2.2.33.2-1ubuntu4.61:2.2.33.2-1ubuntu4.71:2.2.33.2-1ubuntu4.8	None known

Show 5 moreShow less

Affected packages
Package	Affected	Fixed
`dovecot` Ubuntu:20.04:LTS	All versions, plus listed versions 1:2.3.4.1-5ubuntu31:2.3.7.2-1ubuntu11:2.3.7.2-1ubuntu21:2.3.7.2-1ubuntu31:2.3.7.2-1ubuntu3.1 Show 6 moreShow less 1:2.3.7.2-1ubuntu3.21:2.3.7.2-1ubuntu3.31:2.3.7.2-1ubuntu3.41:2.3.7.2-1ubuntu3.51:2.3.7.2-1ubuntu3.61:2.3.7.2-1ubuntu3.7	None known
`dovecot` Ubuntu:22.04:LTS	All versions, plus listed versions 1:2.3.13+dfsg1-1ubuntu31:2.3.16+dfsg1-3ubuntu11:2.3.16+dfsg1-3ubuntu21:2.3.16+dfsg1-3ubuntu2.11:2.3.16+dfsg1-3ubuntu2.2 Show 5 moreShow less 1:2.3.16+dfsg1-3ubuntu2.41:2.3.16+dfsg1-3ubuntu2.61:2.3.16+dfsg1-3ubuntu2.71:2.3.16+dfsg1-3ubuntu2.81:2.3.16+dfsg1-3ubuntu2.9	None known
`dovecot` Ubuntu:24.04:LTS	All versions, plus listed versions 1:2.3.20+dfsg1-1ubuntu31:2.3.21+dfsg1-2ubuntu11:2.3.21+dfsg1-2ubuntu21:2.3.21+dfsg1-2ubuntu41:2.3.21+dfsg1-2ubuntu5 Show 6 moreShow less 1:2.3.21+dfsg1-2ubuntu61:2.3.21+dfsg1-2ubuntu6.11:2.3.21+dfsg1-2ubuntu6.21:2.3.21+dfsg1-2ubuntu6.31:2.3.21+dfsg1-2ubuntu6.41:2.3.21+dfsg1-2ubuntu6.5	None known
`dovecot` Ubuntu:26.04:LTS	All versions, plus listed versions 1:2.4.1+dfsg1-5ubuntu41:2.4.1+dfsg1-5ubuntu51:2.4.2+dfsg1-3ubuntu11:2.4.2+dfsg1-3ubuntu21:2.4.2+dfsg1-3ubuntu2.1	None known
`dovecot24` openSUSE:Leap 16.0 From an advisory covering 24 CVEs	before 2.4.4-160000.2.1	2.4.4-160000.2.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected
Nov 5, 2026	facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-40204 is a low vulnerability (CVSS 3.1) in Open-xchange Gmbh Ox Dovecot Ce, published August 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in dovecot 1:2.3.19.1+dfsg1-2.1+deb12u7.

References

Show 53 moreShow less