Every CVE Search/ Get API key

CVE-2026-42007

An attacker that has valid credentials can use a Sieve script with the editheader extension to...

9.1 CriticalFix available

An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during mail delivery, which can crash the delivery process and may allow execution of arbitrary code in the context of that process. Disable the Sieve editheader extension. Update to non-vulnerable version. No publicly available exploits are known.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
High

Exploit likelihood

0.34%Up 0.1 points since Aug 29, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.1

An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during mail delivery, which can crash the delivery process and may allow execution of arbitrary code in the context of that process. Disable the Sieve editheader extension. Update to non-vulnerable version. No publicly available exploits are known.

Record
CVE-2026-42007
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Weakness
CWE-416
Updated
2026-11-02
EUVDEUVD-2026-67672 9.1

An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during mail delivery, which can crash the delivery process and may allow execution of arbitrary code in the context of that process. Disable the Sieve editheader extension. Update to non-vulnerable version. No publicly available exploits are known.

Record
EUVD-2026-67672
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-9h72-j5f4-5cpc 9.1

An attacker that has valid credentials can use a Sieve script with the editheader extension to...

An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during mail delivery, which can crash the delivery process and may allow execution of arbitrary code in the context of that process. Disable the Sieve editheader extension. Update to non-vulnerable version. No publicly available exploits are known.

Record
GHSA-9h72-j5f4-5cpc
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Weakness
CWE-416
Updated
2026-11-02
NVD 9.1

An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during mail delivery, which can crash the delivery process and may allow execution of arbitrary code in the context of that process. Disable the Sieve editheader extension. Update to non-vulnerable version. No publicly available exploits are known.

Record
CVE-2026-42007
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Weakness
CWE-416
Updated
2026-11-02
OSVALPINE-CVE-2026-42007 9.1

An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during mail delivery, which can crash the delivery process and may allow execution of arbitrary code in the context of that process. Disable the Sieve editheader extension. Update to non-vulnerable version. No publicly available exploits are known.

Record
ALPINE-CVE-2026-42007
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2026-42007 9.1

An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during mail delivery, which can crash the delivery process and may allow execution of arbitrary code in the context of that process. Disable the Sieve editheader extension. Update to non-vulnerable version. No publicly available exploits are known.

Record
DEBIAN-CVE-2026-42007
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Updated
2026-11-02
Show 23 moreShow less
OSVRHSA-2026:76763 9.1

Red Hat Security Advisory: dovecot security, bug fix, and enhancement update

Record
RHSA-2026:76763
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:79371 9.1

Red Hat Security Advisory: dovecot security update

Record
RHSA-2026:79371
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:80825 9.1

Red Hat Security Advisory: dovecot security update

Record
RHSA-2026:80825
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Updated
2026-11-02
OSVRLSA-2026:76763 9.1

Important: dovecot security, bug fix, and enhancement update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.

Security Fix(es):

  • dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)

  • dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)

  • dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)

  • dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)

  • dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)

  • dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)

  • dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)

  • dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)

Bug Fix(es) and Enhancement(s):

  • Dovecot crashes when accessing mailbox with: "Panic: file mail-user.c: line 229 (mail_user_deinit): assertion failed: ((*user)->refcount == 1)" (JIRA:Rocky Linux-176273)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:76763
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Updated
2026-11-02
OSVRLSA-2026:79371 9.1

Important: dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.

Security Fix(es):

  • dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)

  • dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)

  • dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)

  • dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)

  • dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)

  • dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)

  • dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)

  • dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:79371
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Updated
2026-11-02
OSVRLSA-2026:80825 9.1

Important: dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.

Security Fix(es):

  • dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)

  • dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)

  • dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)

  • dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)

  • dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)

  • dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)

  • dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)

  • dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:80825
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-42007 9.1

An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during mail delivery, which can crash the delivery process and may allow execution of arbitrary code in the context of that process. Disable the Sieve editheader extension. Update to non-vulnerable version. No publicly available exploits are known.

Record
UBUNTU-CVE-2026-42007
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Updated
2026-11-02
OSVALSA-2026:76763 No score

Important: dovecot security, bug fix, and enhancement update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.

Security Fix(es):

  • dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)
  • dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)
  • dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)
  • dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)
  • dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)
  • dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)
  • dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)
  • dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)

Bug Fix(es) and Enhancement(s):

  • Dovecot crashes when accessing mailbox with: "Panic: file mail-user.c: line 229 (mail_user_deinit): assertion failed: ((*user)->refcount == 1)" (JIRA:AlmaLinux-176273)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:76763
Updated
2026-11-02
OSVALSA-2026:79371 No score

Important: dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.

Security Fix(es):

  • dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)
  • dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)
  • dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)
  • dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)
  • dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)
  • dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)
  • dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)
  • dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:79371
Updated
2026-11-02
OSVALSA-2026:80825 No score

Important: dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.

Security Fix(es):

  • dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)
  • dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)
  • dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)
  • dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)
  • dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)
  • dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)
  • dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)
  • dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:80825
Updated
2026-11-02
OSVAZL-98298 No score

CVE-2026-42007 affecting package dovecot 2.3.20-1

An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during mail delivery, which can crash the delivery process and may allow execution of arbitrary code in the context of that process. Disable the Sieve editheader extension. Update to non-vulnerable version. No publicly available exploits are known.

Record
AZL-98298
Updated
2026-11-05
OSVCLSA-2026-1792570553 No score

dovecot: Fix of 7 CVEs

  • CVE-2026-27852: bound the transient RFC 2231 parameter list and the MIME parameter budget so a single oversized Content-Type header cannot exhaust imap memory
  • CVE-2026-33263: track SMTP server connection closure so submission-login does not keep using a closed connection
  • CVE-2026-33605: fix ManageSieve parser handling of a single-byte quoted string read in managesieve-login
  • CVE-2026-40018: connect before expanding the passdb-sql password query and refuse to escape in the MySQL driver without a connection instead of escaping with the default charset
  • CVE-2026-42007: fix Sieve editheader edit-mail handling of deleted and NUL-containing header values
  • CVE-2026-42391: account external key/value pairs in the IMAP login ID command so a client cannot send an unbounded number of them
  • CVE-2026-73208: validate the OAuth2 token audience and stop falling back to the aud claim when audience is configured
Record
CLSA-2026-1792570553
Updated
2026-11-02
OSVCLSA-2026-1792596933 No score

dovecot: Fix of CVE-2026-42007

  • CVE-2026-42007: pigeonhole: sieve editheader: reset header-index first pointers before rebuilding the index and copy raw header data with memcpy instead of i_strndup
Record
CLSA-2026-1792596933
Updated
2026-11-02
OSVCLSA-2026-1792753135 No score

dovecot: Fix of CVE-2026-42007

  • CVE-2026-42007: fix use-after-free and NUL-truncated header info leak in bundled pigeonhole edit-mail
Record
CLSA-2026-1792753135
Updated
2026-11-02
OSVCLSA-2026-1792753365 No score

dovecot: Fix of CVE-2026-42007

  • CVE-2026-42007: fix use-after-free and NUL-truncated header info leak in bundled pigeonhole edit-mail
Record
CLSA-2026-1792753365
Updated
2026-11-02
OSVCLSA-2026-1792764227 No score

dovecot: Fix of CVE-2026-42007

  • CVE-2026-42007: deliver the bundled pigeonhole edit-mail fix with direct regressions for no-snapshot deletion and header replacement
Record
CLSA-2026-1792764227
Updated
2026-11-02
OSVCLSA-2026-1792764393 No score

dovecot: Fix of CVE-2026-42007

  • CVE-2026-42007: deliver the bundled pigeonhole edit-mail fix with direct regressions for no-snapshot deletion and header replacement
Record
CLSA-2026-1792764393
Updated
2026-11-02
OSVMGASA-2026-0385 No score

Updated dovecot package fixes security vulnerabilities

submission-login: Panic when mail_max_userip_connections is reached: Panic: epoll_ctl(del, 8) failed: Bad file descriptor. (CVE-2026-33263) Dovecot IMAP LIST match_sub() Exponential Backtracking — CPU Denial of Service. (CVE-2026-33607) DoS by sending mail with bad header. (CVE-2026-27852) dsync: Mail content can cause dsync protocol injection. (CVE-2026-33606) SMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return. (CVE-2026-33604) IMAP THREAD REFERENCES O(N²) CPU DoS via Crafted References Header (index-thread-links.c). (CVE-2026-40014) pigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT. (CVE-2026-40013) managesieve-login: Pre-auth crash. (CVE-2026-33605) MySQL multi-byte escaping wrong. (CVE-2026-40018) v2.4.3 regression: managesieve-login pre-auth infinite loop. (CVE-2026-40019) imap-hibernate can be crashed. (CVE-2026-40015) IMAP THREAD O(M³) CPU DoS via CRC32 Hash Collision in strmap (mail-index-strmap.c / hash2.c). (CVE-2026-40017) IMAP Compression Can Reveal Whether a Small Synced Email Body Matches Sender-Chosen Text. (CVE-2026-40203) Sieve editheader RCE. (CVE-2026-42007) acl: lda_mailbox_autocreate can bypass acl restrictions. (CVE-2026-40204) OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path. (CVE-2026-40205) XCLIENT FORWARD= bare token not namespaced, allows nopassword injection via trusted proxy. (CVE-2026-42008) Single NUL-Byte XCLIENT FORWARD Payload Crashes. (CVE-2026-42395) doveadm_password or api key length can still be leaked with timing comparisons. (CVE-2026-42393) Sieve resource usage tracking lost when active script changes. (CVE-2026-52681) imap-urlauth leaks memory into user-visible error messages. (CVE-2026-42392) auth: db-oauth2: aud claim used as fallback for missing scope claim. (CVE-2026-73208) imap-login crash: Self-recursion on zero-output decompress chunks. (CVE-2026-73209) imap: Pre-login memory/CPU growth with ID command. (CVE-2026-42391) IMAP: COMPRESS ZSTD can cause excessive memory usage. (CVE-2026-52687)

Record
MGASA-2026-0385
Updated
2026-11-02
OSVopenSUSE-SU-2026:11629-1 No score

dovecot24-2.4.5-1.1 on GA media

These are all security issues fixed in the dovecot24-2.4.5-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11629-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21720-1 No score

Security update for dovecot24

This update for dovecot24 fixes the following issues:

Update to 2.4.5.

  • CVE-2026-33263: submission-login: panic when mail_max_userip_connections is reached (bsc#1276794).
  • CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799).
  • CVE-2026-33604: SMTP smuggling via missing dot-stuffing after bare carriage return (bsc#1276802).
  • CVE-2026-33605: managesieve-login: pre-auth crash (bsc#1276809).
  • CVE-2026-33606: dsync: mail content can cause dsync protocol injection (bsc#1276800).
  • CVE-2026-33607: IMAP LIST match_sub() exponential backtracking leading to CPU denial of service (bsc#1276795).
  • CVE-2026-40013: stack buffer underflow in pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT (bsc#1276807).
  • CVE-2026-40014: CPU DoS via crafted references header (bsc#1276804).
  • CVE-2026-40015: imap-hibernate can be crashed (bsc#1276812).
  • CVE-2026-40017: CPU DoS via CRC32 hash collision in strmap (bsc#1276813).
  • CVE-2026-40018: MySQL multi-byte escaping performed incorrectly (bsc#1276810).
  • CVE-2026-40203: IMAP compression can reveal whether a small synced email body matches sender-chosen text (bsc#1276815).
  • CVE-2026-40204: lda_mailbox_autocreate can bypass ACL restrictions (bsc#1276819).
  • CVE-2026-40205: OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path (bsc#1276820).
  • CVE-2026-42007: sieve editheader RCE (bsc#1276817).
  • CVE-2026-42008: XCLIENT FORWARD= bare token not namespaced (bsc#1276824).
  • CVE-2026-42391: imap: pre-login memory/CPU growth with ID command (bsc#1276835).
  • CVE-2026-42392: imap-urlauth leaks memory into user-visible error messages (bsc#1276829).
  • CVE-2026-42393: doveadm_password or api key length can be leaked with timing comparisons (bsc#1276827).
  • CVE-2026-52687: imap: COMPRESS ZSTD can cause excessive memory usage (bsc#1276837).
  • CVE-2026-42395: single NUL-byte XCLIENT FORWARD payload crashes (bsc#1276826).
  • CVE-2026-52681: sieve resource usage tracking lost when active script changes (bsc#1276828).
  • CVE-2026-73208: auth: db-oauth2: aud claim used as fallback for missing scope claim (bsc#1276830).
  • CVE-2026-73209: imap-login crash due to self-recursion on zero-output decompress chunks (bsc#1276833).
Record
openSUSE-SU-2026:21720-1
Updated
2026-11-02
OSVSUSE-SU-2026:23595-1 No score

Security update for dovecot24

This update for dovecot24 fixes the following issues:

Update to 2.4.5.

  • CVE-2026-33263: submission-login: panic when mail_max_userip_connections is reached (bsc#1276794).
  • CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799).
  • CVE-2026-33604: SMTP smuggling via missing dot-stuffing after bare carriage return (bsc#1276802).
  • CVE-2026-33605: managesieve-login: pre-auth crash (bsc#1276809).
  • CVE-2026-33606: dsync: mail content can cause dsync protocol injection (bsc#1276800).
  • CVE-2026-33607: IMAP LIST match_sub() exponential backtracking leading to CPU denial of service (bsc#1276795).
  • CVE-2026-40013: stack buffer underflow in pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT (bsc#1276807).
  • CVE-2026-40014: CPU DoS via crafted references header (bsc#1276804).
  • CVE-2026-40015: imap-hibernate can be crashed (bsc#1276812).
  • CVE-2026-40017: CPU DoS via CRC32 hash collision in strmap (bsc#1276813).
  • CVE-2026-40018: MySQL multi-byte escaping performed incorrectly (bsc#1276810).
  • CVE-2026-40203: IMAP compression can reveal whether a small synced email body matches sender-chosen text (bsc#1276815).
  • CVE-2026-40204: lda_mailbox_autocreate can bypass ACL restrictions (bsc#1276819).
  • CVE-2026-40205: OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path (bsc#1276820).
  • CVE-2026-42007: sieve editheader RCE (bsc#1276817).
  • CVE-2026-42008: XCLIENT FORWARD= bare token not namespaced (bsc#1276824).
  • CVE-2026-42391: imap: pre-login memory/CPU growth with ID command (bsc#1276835).
  • CVE-2026-42392: imap-urlauth leaks memory into user-visible error messages (bsc#1276829).
  • CVE-2026-42393: doveadm_password or api key length can be leaked with timing comparisons (bsc#1276827).
  • CVE-2026-52687: imap: COMPRESS ZSTD can cause excessive memory usage (bsc#1276837).
  • CVE-2026-42395: single NUL-byte XCLIENT FORWARD payload crashes (bsc#1276826).
  • CVE-2026-52681: sieve resource usage tracking lost when active script changes (bsc#1276828).
  • CVE-2026-73208: auth: db-oauth2: aud claim used as fallback for missing scope claim (bsc#1276830).
  • CVE-2026-73209: imap-login crash due to self-recursion on zero-output decompress chunks (bsc#1276833).
Record
SUSE-SU-2026:23595-1
Updated
2026-11-02
OSVSUSE-SU-2026:3919-1 No score

Security update for dovecot22

This update for dovecot22 fixes the following issues:

Security issues fixed:

  • CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799).
  • CVE-2026-33604: SMTP smuggling via missing dot-stuffing after bare carriage return (bsc#1276802).
  • CVE-2026-33605: managesieve-login: pre-auth crash (bsc#1276809).
  • CVE-2026-33606: dsync: mail content can cause dsync protocol injection (bsc#1276800).
  • CVE-2026-33607: IMAP LIST match_sub() exponential backtracking leading to CPU denial of service (bsc#1276795).
  • CVE-2026-40014: CPU DoS via crafted references header (bsc#1276804).
  • CVE-2026-40015: imap-hibernate can be crashed (bsc#1276812).
  • CVE-2026-40019: managesieve-login pre-auth infinite loop (bsc#1276811).
  • CVE-2026-40203: IMAP compression can reveal whether a small synced email body matches sender-chosen text (bsc#1276815).
  • CVE-2026-42007: sieve editheader RCE (bsc#1276817).
  • CVE-2026-42391: imap: pre-login memory/CPU growth with ID command (bsc#1276835).
  • CVE-2026-42393: doveadm_password or api key length can be leaked with timing comparisons (bsc#1276827).
  • CVE-2026-52687: imap: COMPRESS ZSTD can cause excessive memory usage (bsc#1276837).
  • CVE-2026-73209: imap-login crash due to self-recursion on zero-output decompress chunks (bsc#1276833).
  • multiple security fixes (bsc#1276792).

Other updates and bugfixes:

  • Non-CVE hardening taken from the same upstream release:
    • sieve: requiring the same extension repeatedly grew the default argument override chain, which is walked recursively - a crafted script could overflow the stack
    • sieve: ${unicode:...} hex values could overflow an unsigned int and wrap back into the valid Unicode range; the hex parser also read one byte past the end of the buffer
    • sieve variables: the ${1234...} numeric index overflowed a signed int
    • sieve enotify: a single script could emit an unlimited number of notification messages; limited to 10 as upstream does
Record
SUSE-SU-2026:3919-1
Updated
2026-11-02
OSVSUSE-SU-2026:4139-1 No score

Security update for dovecot23

This update for dovecot23 fixes the following issues:

  • CVE-2024-23184: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive (bsc#1229184).
  • CVE-2024-23185: large headers can cause resource exhaustion when parsing message (bsc#1229183).
  • CVE-2025-59028: Invalid base64 authentication can cause DoS for other logins (bsc#1260894).
  • CVE-2025-59031: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing (bsc#1260895).
  • CVE-2025-59032: pigeonhole: ManageSieve panic occurs with sieve-connect as a client (bsc#1260902).
  • CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799).
  • CVE-2026-27855: OTP driver vulnerable to replay attack (bsc#1260900).
  • CVE-2026-27856: Doveadm credentials were not checked using timing-safe checking function (bsc#1260899).
  • CVE-2026-27857: sending excessive parenthesis causes imap-login to use excessive memory (bsc#1260898).
  • CVE-2026-27858: pigeonhole: managesieve-login can allocate large amount of memory during authentication (bsc#1260901).
  • CVE-2026-27859: excessive RFC 2231 MIME parameters in email would can excessive CPU usage (bsc#1260897).
  • CVE-2026-33263: submission-login: Panic when mail_max_userip_connections is reached (bsc#1276794).
  • CVE-2026-33603: login: base64 input can contain tabs that bypass IPC protection (bsc#1265147).
  • CVE-2026-33604: SMTP Smuggling via Missing Dot-Stuffing (bsc#1276802).
  • CVE-2026-33605: managesieve-login: Pre-auth crash (bsc#1276809).
  • CVE-2026-33606: dsync: Mail content can cause dsync protocol injection (bsc#1276800).
  • CVE-2026-33607: IMAP LIST match_sub() Exponential Backtracking -- CPU Denial of Service (bsc#1276795).
  • CVE-2026-40014: CPU DoS via Crafted References Header (bsc#1276804).
  • CVE-2026-40015: imap-hibernate can be crashed (bsc#1276812).
  • CVE-2026-40016: Sieve :contains/:matches O(NxM) substring match bypasses sieve_max_cpu_time limit (bsc#1265148).
  • CVE-2026-40019: managesieve-login pre-auth infinite loop (bsc#1276811).
  • CVE-2026-40020: IMAP folders can be shared-spammed to everyone (bsc#1265149).
  • CVE-2026-40203: IMAP Compression Can Reveal Whether a Small Synced Email Body Matches Sender-Chosen Text (bsc#1276815).
  • CVE-2026-40205: OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path (bsc#1276820).
  • CVE-2026-42006: imap-login: uncontrolled memory usage with excessive bracing over IMAP (bsc#1265150).
  • CVE-2026-42007: editheader RCE (bsc#1276817).
  • CVE-2026-42008: XCLIENT FORWARD= bare token not namespaced (bsc#1276824).
  • CVE-2026-42391: imap: Pre-login memory/CPU growth with ID command (bsc#1276835).
  • CVE-2026-42393: doveadm_password or api key length can still be leaked with timing comparisons (bsc#1276827).
  • CVE-2026-42395: Single NUL-Byte XCLIENT FORWARD Payload Crashes (bsc#1276826).
  • CVE-2026-52681: Sieve resource usage tracking lost when active script changes (bsc#1276828).
  • CVE-2026-52687: IMAP: COMPRESS ZSTD can cause excessive memory usage (bsc#1276837).
  • CVE-2026-73208: auth: db-oauth2: aud claim used as fallback for missing scope claim (bsc#1276830).
  • CVE-2026-73209: imap-login crash: Self-recursion on zero-output decompress chunks (bsc#1276833).

Changes for dovecot23:

  • Update to version 2.3.21.1.
Record
SUSE-SU-2026:4139-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dovecot
Alpine:v3.23
 before 2.4.5-r0
2.4.5-r0
dovecot
Alpine:v3.24
 before 2.4.5-r0
2.4.5-r0
dovecot
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:2.3.16-16.el8_10
1:2.3.16-16.el8_10
dovecot-devel
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:2.3.16-16.el8_10
1:2.3.16-16.el8_10
dovecot-mysql
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:2.3.16-16.el8_10
1:2.3.16-16.el8_10
dovecot-pgsql
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:2.3.16-16.el8_10
1:2.3.16-16.el8_10
dovecot-pigeonhole
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:2.3.16-16.el8_10
1:2.3.16-16.el8_10
dovecot
AlmaLinux:10
From an advisory covering 8 CVEs
 before 1:2.3.21-19.el10_2.8
1:2.3.21-19.el10_2.8
dovecot-devel
AlmaLinux:10
From an advisory covering 8 CVEs
 before 1:2.3.21-19.el10_2.8
1:2.3.21-19.el10_2.8
dovecot-mysql
AlmaLinux:10
From an advisory covering 8 CVEs
 before 1:2.3.21-19.el10_2.8
1:2.3.21-19.el10_2.8
Show 111 moreShow less
Affected packages
PackageAffectedFixed
dovecot-pgsql
AlmaLinux:10
From an advisory covering 8 CVEs
 before 1:2.3.21-19.el10_2.8
1:2.3.21-19.el10_2.8
dovecot-pigeonhole
AlmaLinux:10
From an advisory covering 8 CVEs
 before 1:2.3.21-19.el10_2.8
1:2.3.21-19.el10_2.8
dovecot
AlmaLinux:9
From an advisory covering 8 CVEs
 before 1:2.3.16-18.el9_8.8
1:2.3.16-18.el9_8.8
dovecot-devel
AlmaLinux:9
From an advisory covering 8 CVEs
 before 1:2.3.16-18.el9_8.8
1:2.3.16-18.el9_8.8
dovecot-mysql
AlmaLinux:9
From an advisory covering 8 CVEs
 before 1:2.3.16-18.el9_8.8
1:2.3.16-18.el9_8.8
dovecot-pgsql
AlmaLinux:9
From an advisory covering 8 CVEs
 before 1:2.3.16-18.el9_8.8
1:2.3.16-18.el9_8.8
dovecot-pigeonhole
AlmaLinux:9
From an advisory covering 8 CVEs
 before 1:2.3.16-18.el9_8.8
1:2.3.16-18.el9_8.8
dovecot
Azure Linux:3
 through 2.3.20-1 None known
dovecot
TuxCare:AlmaLinux:9.2
From an advisory covering 7 CVEs
 before 1:2.3.16-8.el9_2.tuxcare.els8
1:2.3.16-8.el9_2.tuxcare.els8
dovecot-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 7 CVEs
 before 1:2.3.16-8.el9_2.tuxcare.els8
1:2.3.16-8.el9_2.tuxcare.els8
dovecot-mysql
TuxCare:AlmaLinux:9.2
From an advisory covering 7 CVEs
 before 1:2.3.16-8.el9_2.tuxcare.els8
1:2.3.16-8.el9_2.tuxcare.els8
dovecot-pgsql
TuxCare:AlmaLinux:9.2
From an advisory covering 7 CVEs
 before 1:2.3.16-8.el9_2.tuxcare.els8
1:2.3.16-8.el9_2.tuxcare.els8
dovecot-pigeonhole
TuxCare:AlmaLinux:9.2
From an advisory covering 7 CVEs
 before 1:2.3.16-8.el9_2.tuxcare.els8
1:2.3.16-8.el9_2.tuxcare.els8
dovecot
TuxCare:AlmaLinux:9.6
 before 1:2.3.16-15.el9.tuxcare.els5
1:2.3.16-15.el9.tuxcare.els5
dovecot-devel
TuxCare:AlmaLinux:9.6
 before 1:2.3.16-15.el9.tuxcare.els5
1:2.3.16-15.el9.tuxcare.els5
dovecot-mysql
TuxCare:AlmaLinux:9.6
 before 1:2.3.16-15.el9.tuxcare.els5
1:2.3.16-15.el9.tuxcare.els5
dovecot-pgsql
TuxCare:AlmaLinux:9.6
 before 1:2.3.16-15.el9.tuxcare.els5
1:2.3.16-15.el9.tuxcare.els5
dovecot-pigeonhole
TuxCare:AlmaLinux:9.6
 before 1:2.3.16-15.el9.tuxcare.els5
1:2.3.16-15.el9.tuxcare.els5
dovecot
TuxCare:OracleLinux:7
 before 1:2.2.36-8.0.3.el7.tuxcare.els2
1:2.2.36-8.0.3.el7.tuxcare.els2
dovecot-devel
TuxCare:OracleLinux:7
 before 1:2.2.36-8.0.3.el7.tuxcare.els2
1:2.2.36-8.0.3.el7.tuxcare.els2
dovecot-mysql
TuxCare:OracleLinux:7
 before 1:2.2.36-8.0.3.el7.tuxcare.els2
1:2.2.36-8.0.3.el7.tuxcare.els2
dovecot-pgsql
TuxCare:OracleLinux:7
 before 1:2.2.36-8.0.3.el7.tuxcare.els2
1:2.2.36-8.0.3.el7.tuxcare.els2
dovecot-pigeonhole
TuxCare:OracleLinux:7
 before 1:2.2.36-8.0.3.el7.tuxcare.els2
1:2.2.36-8.0.3.el7.tuxcare.els2
dovecot
TuxCare:RHEL:7
 before 1:2.2.36-8.0.3.el7.tuxcare.els2
1:2.2.36-8.0.3.el7.tuxcare.els2
dovecot-devel
TuxCare:RHEL:7
 before 1:2.2.36-8.0.3.el7.tuxcare.els2
1:2.2.36-8.0.3.el7.tuxcare.els2
dovecot-mysql
TuxCare:RHEL:7
 before 1:2.2.36-8.0.3.el7.tuxcare.els2
1:2.2.36-8.0.3.el7.tuxcare.els2
dovecot-pgsql
TuxCare:RHEL:7
 before 1:2.2.36-8.0.3.el7.tuxcare.els2
1:2.2.36-8.0.3.el7.tuxcare.els2
dovecot-pigeonhole
TuxCare:RHEL:7
 before 1:2.2.36-8.0.3.el7.tuxcare.els2
1:2.2.36-8.0.3.el7.tuxcare.els2
dovecot
TuxCare:OracleLinux:7
 before 1:2.2.36-8.0.3.el7.tuxcare.els3
1:2.2.36-8.0.3.el7.tuxcare.els3
dovecot-devel
TuxCare:OracleLinux:7
 before 1:2.2.36-8.0.3.el7.tuxcare.els3
1:2.2.36-8.0.3.el7.tuxcare.els3
dovecot-mysql
TuxCare:OracleLinux:7
 before 1:2.2.36-8.0.3.el7.tuxcare.els3
1:2.2.36-8.0.3.el7.tuxcare.els3
dovecot-pgsql
TuxCare:OracleLinux:7
 before 1:2.2.36-8.0.3.el7.tuxcare.els3
1:2.2.36-8.0.3.el7.tuxcare.els3
dovecot-pigeonhole
TuxCare:OracleLinux:7
 before 1:2.2.36-8.0.3.el7.tuxcare.els3
1:2.2.36-8.0.3.el7.tuxcare.els3
dovecot
TuxCare:RHEL:7
 before 1:2.2.36-8.0.3.el7.tuxcare.els3
1:2.2.36-8.0.3.el7.tuxcare.els3
dovecot-devel
TuxCare:RHEL:7
 before 1:2.2.36-8.0.3.el7.tuxcare.els3
1:2.2.36-8.0.3.el7.tuxcare.els3
dovecot-mysql
TuxCare:RHEL:7
 before 1:2.2.36-8.0.3.el7.tuxcare.els3
1:2.2.36-8.0.3.el7.tuxcare.els3
dovecot-pgsql
TuxCare:RHEL:7
 before 1:2.2.36-8.0.3.el7.tuxcare.els3
1:2.2.36-8.0.3.el7.tuxcare.els3
dovecot-pigeonhole
TuxCare:RHEL:7
 before 1:2.2.36-8.0.3.el7.tuxcare.els3
1:2.2.36-8.0.3.el7.tuxcare.els3
dovecot
Debian:12
 before 1:2.3.19.1+dfsg1-2.1+deb12u7, plus listed versions
1:2.3.19.1+dfsg1-2.11:2.3.19.1+dfsg1-2.1+deb12u11:2.3.19.1+dfsg1-2.1+deb12u21:2.3.19.1+dfsg1-2.1+deb12u31:2.3.19.1+dfsg1-2.1+deb12u41:2.3.19.1+dfsg1-2.1+deb12u51:2.3.19.1+dfsg1-2.1+deb12u6
1:2.3.19.1+dfsg1-2.1+deb12u7
dovecot
Debian:13
 before 1:2.4.1+dfsg1-6+deb13u7, plus listed versions
1:2.4.1+dfsg1-61:2.4.1+dfsg1-6+deb13u11:2.4.1+dfsg1-6+deb13u21:2.4.1+dfsg1-6+deb13u31:2.4.1+dfsg1-6+deb13u41:2.4.1+dfsg1-6+deb13u51:2.4.1+dfsg1-6+deb13u6
1:2.4.1+dfsg1-6+deb13u7
dovecot
Debian:14
 before 1:2.4.5+dfsg1-1, plus listed versions
1:2.4.1+dfsg1-61:2.4.1+dfsg1-71:2.4.1+dfsg1-81:2.4.1+dfsg1-91:2.4.2+dfsg1-1
Show 7 moreShow less
1:2.4.2+dfsg1-21:2.4.2+dfsg1-31:2.4.2+dfsg1-41:2.4.3+dfsg1-11:2.4.3+dfsg1-21:2.4.4+dfsg1-11:2.4.4+dfsg1-2
1:2.4.5+dfsg1-1
dovecot
Mageia:10
From an advisory covering 25 CVEs
 before 2.4.5-2.mga10
2.4.5-2.mga10
dovecot
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:2.3.16-16.el8_10
1:2.3.16-16.el8_10
dovecot-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:2.3.16-16.el8_10
1:2.3.16-16.el8_10
dovecot-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:2.3.16-16.el8_10
1:2.3.16-16.el8_10
dovecot-mysql
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:2.3.16-16.el8_10
1:2.3.16-16.el8_10
dovecot-mysql-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:2.3.16-16.el8_10
1:2.3.16-16.el8_10
dovecot-pgsql
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:2.3.16-16.el8_10
1:2.3.16-16.el8_10
dovecot-pgsql-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:2.3.16-16.el8_10
1:2.3.16-16.el8_10
dovecot-pigeonhole
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:2.3.16-16.el8_10
1:2.3.16-16.el8_10
dovecot-pigeonhole-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:2.3.16-16.el8_10
1:2.3.16-16.el8_10
dovecot
Red Hat:enterprise_linux:8::crb
From an advisory covering 8 CVEs
 before 1:2.3.16-16.el8_10
1:2.3.16-16.el8_10
dovecot-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 8 CVEs
 before 1:2.3.16-16.el8_10
1:2.3.16-16.el8_10
dovecot-debugsource
Red Hat:enterprise_linux:8::crb
From an advisory covering 8 CVEs
 before 1:2.3.16-16.el8_10
1:2.3.16-16.el8_10
dovecot-devel
Red Hat:enterprise_linux:8::crb
From an advisory covering 8 CVEs
 before 1:2.3.16-16.el8_10
1:2.3.16-16.el8_10
dovecot-mysql-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 8 CVEs
 before 1:2.3.16-16.el8_10
1:2.3.16-16.el8_10
dovecot-pgsql-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 8 CVEs
 before 1:2.3.16-16.el8_10
1:2.3.16-16.el8_10
dovecot-pigeonhole-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 8 CVEs
 before 1:2.3.16-16.el8_10
1:2.3.16-16.el8_10
dovecot
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 1:2.3.21-19.el10_2.8
1:2.3.21-19.el10_2.8
dovecot-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 1:2.3.21-19.el10_2.8
1:2.3.21-19.el10_2.8
dovecot-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 1:2.3.21-19.el10_2.8
1:2.3.21-19.el10_2.8
dovecot-mysql
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 1:2.3.21-19.el10_2.8
1:2.3.21-19.el10_2.8
dovecot-mysql-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 1:2.3.21-19.el10_2.8
1:2.3.21-19.el10_2.8
dovecot-pgsql
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 1:2.3.21-19.el10_2.8
1:2.3.21-19.el10_2.8
dovecot-pgsql-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 1:2.3.21-19.el10_2.8
1:2.3.21-19.el10_2.8
dovecot-pigeonhole
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 1:2.3.21-19.el10_2.8
1:2.3.21-19.el10_2.8
dovecot-pigeonhole-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 1:2.3.21-19.el10_2.8
1:2.3.21-19.el10_2.8
dovecot-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 1:2.3.21-19.el10_2.8
1:2.3.21-19.el10_2.8
dovecot
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 1:2.3.16-18.el9_8.8
1:2.3.16-18.el9_8.8
dovecot-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 1:2.3.16-18.el9_8.8
1:2.3.16-18.el9_8.8
dovecot-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 1:2.3.16-18.el9_8.8
1:2.3.16-18.el9_8.8
dovecot-mysql
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 1:2.3.16-18.el9_8.8
1:2.3.16-18.el9_8.8
dovecot-mysql-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 1:2.3.16-18.el9_8.8
1:2.3.16-18.el9_8.8
dovecot-pgsql
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 1:2.3.16-18.el9_8.8
1:2.3.16-18.el9_8.8
dovecot-pgsql-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 1:2.3.16-18.el9_8.8
1:2.3.16-18.el9_8.8
dovecot-pigeonhole
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 1:2.3.16-18.el9_8.8
1:2.3.16-18.el9_8.8
dovecot-pigeonhole-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 1:2.3.16-18.el9_8.8
1:2.3.16-18.el9_8.8
dovecot
Red Hat:enterprise_linux:9::crb
From an advisory covering 8 CVEs
 before 1:2.3.16-18.el9_8.8
1:2.3.16-18.el9_8.8
dovecot-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 8 CVEs
 before 1:2.3.16-18.el9_8.8
1:2.3.16-18.el9_8.8
dovecot-debugsource
Red Hat:enterprise_linux:9::crb
From an advisory covering 8 CVEs
 before 1:2.3.16-18.el9_8.8
1:2.3.16-18.el9_8.8
dovecot-devel
Red Hat:enterprise_linux:9::crb
From an advisory covering 8 CVEs
 before 1:2.3.16-18.el9_8.8
1:2.3.16-18.el9_8.8
dovecot-mysql-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 8 CVEs
 before 1:2.3.16-18.el9_8.8
1:2.3.16-18.el9_8.8
dovecot-pgsql-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 8 CVEs
 before 1:2.3.16-18.el9_8.8
1:2.3.16-18.el9_8.8
dovecot-pigeonhole-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 8 CVEs
 before 1:2.3.16-18.el9_8.8
1:2.3.16-18.el9_8.8
dovecot
Rocky Linux:8
From an advisory covering 8 CVEs
 before 1:2.3.16-16.el8_10
1:2.3.16-16.el8_10
dovecot
Rocky Linux:10
From an advisory covering 8 CVEs
 before 1:2.3.21-19.el10_2.8
1:2.3.21-19.el10_2.8
dovecot
Rocky Linux:9
From an advisory covering 8 CVEs
 before 1:2.3.16-18.el9_8.8
1:2.3.16-18.el9_8.8
dovecot24
SUSE:Linux Enterprise Server 16.0
From an advisory covering 24 CVEs
 before 2.4.4-160000.2.1
2.4.4-160000.2.1
dovecot24
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 24 CVEs
 before 2.4.4-160000.2.1
2.4.4-160000.2.1
dovecot22
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 14 CVEs
 before 2.2.31-19.40.1
2.2.31-19.40.1
dovecot22
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 14 CVEs
 before 2.2.31-19.40.1
2.2.31-19.40.1
dovecot23
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 34 CVEs
 before 2.3.21.1-150200.76.1
2.3.21.1-150200.76.1
dovecot23
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 34 CVEs
 before 2.3.21.1-150200.76.1
2.3.21.1-150200.76.1
dovecot23
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 34 CVEs
 before 2.3.21.1-150200.76.1
2.3.21.1-150200.76.1
dovecot23
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 34 CVEs
 before 2.3.21.1-150200.76.1
2.3.21.1-150200.76.1
dovecot23
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 34 CVEs
 before 2.3.21.1-150200.76.1
2.3.21.1-150200.76.1
dovecot23
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 34 CVEs
 before 2.3.21.1-150200.76.1
2.3.21.1-150200.76.1
dovecot23
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 34 CVEs
 before 2.3.21.1-150200.76.1
2.3.21.1-150200.76.1
dovecot23
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 34 CVEs
 before 2.3.21.1-150200.76.1
2.3.21.1-150200.76.1
dovecot23
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 34 CVEs
 before 2.3.21.1-150200.76.1
2.3.21.1-150200.76.1
dovecot23
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 34 CVEs
 before 2.3.21.1-150200.76.1
2.3.21.1-150200.76.1
dovecot23
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 34 CVEs
 before 2.3.21.1-150200.76.1
2.3.21.1-150200.76.1
dovecot
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1:2.1.7-7ubuntu31:2.2.9-1ubuntu11:2.2.9-1ubuntu21:2.2.9-1ubuntu2.11:2.2.9-1ubuntu2.3
Show 7 moreShow less
1:2.2.9-1ubuntu2.41:2.2.9-1ubuntu2.51:2.2.9-1ubuntu2.61:2.2.9-1ubuntu2.6+esm11:2.2.9-1ubuntu2.6+esm21:2.2.9-1ubuntu2.6+esm31:2.2.9-1ubuntu2.6+esm4
 None known
dovecot
Ubuntu:16.04:LTS
 All versions, plus listed versions
1:2.2.18-2ubuntu21:2.2.22-1ubuntu11:2.2.22-1ubuntu21:2.2.22-1ubuntu2.11:2.2.22-1ubuntu2.2
Show 11 moreShow less
1:2.2.22-1ubuntu2.31:2.2.22-1ubuntu2.41:2.2.22-1ubuntu2.61:2.2.22-1ubuntu2.71:2.2.22-1ubuntu2.81:2.2.22-1ubuntu2.91:2.2.22-1ubuntu2.101:2.2.22-1ubuntu2.111:2.2.22-1ubuntu2.121:2.2.22-1ubuntu2.131:2.2.22-1ubuntu2.14
 None known
dovecot
Ubuntu:18.04:LTS
 All versions, plus listed versions
1:2.2.27-3ubuntu11:2.2.33.2-1ubuntu11:2.2.33.2-1ubuntu21:2.2.33.2-1ubuntu31:2.2.33.2-1ubuntu4
Show 8 moreShow less
1:2.2.33.2-1ubuntu4.11:2.2.33.2-1ubuntu4.21:2.2.33.2-1ubuntu4.31:2.2.33.2-1ubuntu4.41:2.2.33.2-1ubuntu4.51:2.2.33.2-1ubuntu4.61:2.2.33.2-1ubuntu4.71:2.2.33.2-1ubuntu4.8
 None known
dovecot
Ubuntu:20.04:LTS
 All versions, plus listed versions
1:2.3.4.1-5ubuntu31:2.3.7.2-1ubuntu11:2.3.7.2-1ubuntu21:2.3.7.2-1ubuntu31:2.3.7.2-1ubuntu3.1
Show 6 moreShow less
1:2.3.7.2-1ubuntu3.21:2.3.7.2-1ubuntu3.31:2.3.7.2-1ubuntu3.41:2.3.7.2-1ubuntu3.51:2.3.7.2-1ubuntu3.61:2.3.7.2-1ubuntu3.7
 None known
dovecot
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:2.3.13+dfsg1-1ubuntu31:2.3.16+dfsg1-3ubuntu11:2.3.16+dfsg1-3ubuntu21:2.3.16+dfsg1-3ubuntu2.11:2.3.16+dfsg1-3ubuntu2.2
Show 5 moreShow less
1:2.3.16+dfsg1-3ubuntu2.41:2.3.16+dfsg1-3ubuntu2.61:2.3.16+dfsg1-3ubuntu2.71:2.3.16+dfsg1-3ubuntu2.81:2.3.16+dfsg1-3ubuntu2.9
 None known
dovecot
Ubuntu:24.04:LTS
 All versions, plus listed versions
1:2.3.20+dfsg1-1ubuntu31:2.3.21+dfsg1-2ubuntu11:2.3.21+dfsg1-2ubuntu21:2.3.21+dfsg1-2ubuntu41:2.3.21+dfsg1-2ubuntu5
Show 6 moreShow less
1:2.3.21+dfsg1-2ubuntu61:2.3.21+dfsg1-2ubuntu6.11:2.3.21+dfsg1-2ubuntu6.21:2.3.21+dfsg1-2ubuntu6.31:2.3.21+dfsg1-2ubuntu6.41:2.3.21+dfsg1-2ubuntu6.5
 None known
dovecot
Ubuntu:26.04:LTS
 All versions, plus listed versions
1:2.4.1+dfsg1-5ubuntu41:2.4.1+dfsg1-5ubuntu51:2.4.2+dfsg1-3ubuntu11:2.4.2+dfsg1-3ubuntu21:2.4.2+dfsg1-3ubuntu2.1
 None known
dovecot24
openSUSE:Tumbleweed
From an advisory covering 22 CVEs
 before 2.4.5-1.1
2.4.5-1.1
dovecot24
openSUSE:Leap 16.0
From an advisory covering 24 CVEs
 before 2.4.4-160000.2.1
2.4.4-160000.2.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-42007 is a critical vulnerability (CVSS 9.1) in Open-xchange Gmbh Ox Dovecot Ce, published August 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 28th percentile. Fixed in dovecot 2.4.5-r0.

References

Show 146 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open