Every CVE Search/ Get API key

CVE-2026-42008

Forwarding information received from a host listed as a trusted proxy is not kept separate from...

4.3 MediumFix available

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.24%Unchanged since Aug 29, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.3

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.

Record
CVE-2026-42008
CVSS 3.1
4.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-287
Updated
2026-11-02
EUVDEUVD-2026-67673 4.3

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.

Record
EUVD-2026-67673
CVSS 3.1
4.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-hwmp-h522-jmhg 4.3

Forwarding information received from a host listed as a trusted proxy is not kept separate from...

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.

Record
GHSA-hwmp-h522-jmhg
CVSS 3.1
4.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-287
Updated
2026-11-02
NVD 4.3

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.

Record
CVE-2026-42008
CVSS 3.1
4.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-287
Updated
2026-11-02
OSVDEBIAN-CVE-2026-42008 4.3

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.

Record
DEBIAN-CVE-2026-42008
CVSS 3.1
4.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-42008 4.3

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.

Record
UBUNTU-CVE-2026-42008
CVSS 3.1
4.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
Show 5 moreShow less
OSVAZL-98325 No score

CVE-2026-42008 affecting package dovecot 2.3.20-1

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.

Record
AZL-98325
Updated
2026-11-05
OSVMGASA-2026-0385 No score

Updated dovecot package fixes security vulnerabilities

submission-login: Panic when mail_max_userip_connections is reached: Panic: epoll_ctl(del, 8) failed: Bad file descriptor. (CVE-2026-33263) Dovecot IMAP LIST match_sub() Exponential Backtracking — CPU Denial of Service. (CVE-2026-33607) DoS by sending mail with bad header. (CVE-2026-27852) dsync: Mail content can cause dsync protocol injection. (CVE-2026-33606) SMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return. (CVE-2026-33604) IMAP THREAD REFERENCES O(N²) CPU DoS via Crafted References Header (index-thread-links.c). (CVE-2026-40014) pigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT. (CVE-2026-40013) managesieve-login: Pre-auth crash. (CVE-2026-33605) MySQL multi-byte escaping wrong. (CVE-2026-40018) v2.4.3 regression: managesieve-login pre-auth infinite loop. (CVE-2026-40019) imap-hibernate can be crashed. (CVE-2026-40015) IMAP THREAD O(M³) CPU DoS via CRC32 Hash Collision in strmap (mail-index-strmap.c / hash2.c). (CVE-2026-40017) IMAP Compression Can Reveal Whether a Small Synced Email Body Matches Sender-Chosen Text. (CVE-2026-40203) Sieve editheader RCE. (CVE-2026-42007) acl: lda_mailbox_autocreate can bypass acl restrictions. (CVE-2026-40204) OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path. (CVE-2026-40205) XCLIENT FORWARD= bare token not namespaced, allows nopassword injection via trusted proxy. (CVE-2026-42008) Single NUL-Byte XCLIENT FORWARD Payload Crashes. (CVE-2026-42395) doveadm_password or api key length can still be leaked with timing comparisons. (CVE-2026-42393) Sieve resource usage tracking lost when active script changes. (CVE-2026-52681) imap-urlauth leaks memory into user-visible error messages. (CVE-2026-42392) auth: db-oauth2: aud claim used as fallback for missing scope claim. (CVE-2026-73208) imap-login crash: Self-recursion on zero-output decompress chunks. (CVE-2026-73209) imap: Pre-login memory/CPU growth with ID command. (CVE-2026-42391) IMAP: COMPRESS ZSTD can cause excessive memory usage. (CVE-2026-52687)

Record
MGASA-2026-0385
Updated
2026-11-02
OSVopenSUSE-SU-2026:21720-1 No score

Security update for dovecot24

This update for dovecot24 fixes the following issues:

Update to 2.4.5.

  • CVE-2026-33263: submission-login: panic when mail_max_userip_connections is reached (bsc#1276794).
  • CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799).
  • CVE-2026-33604: SMTP smuggling via missing dot-stuffing after bare carriage return (bsc#1276802).
  • CVE-2026-33605: managesieve-login: pre-auth crash (bsc#1276809).
  • CVE-2026-33606: dsync: mail content can cause dsync protocol injection (bsc#1276800).
  • CVE-2026-33607: IMAP LIST match_sub() exponential backtracking leading to CPU denial of service (bsc#1276795).
  • CVE-2026-40013: stack buffer underflow in pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT (bsc#1276807).
  • CVE-2026-40014: CPU DoS via crafted references header (bsc#1276804).
  • CVE-2026-40015: imap-hibernate can be crashed (bsc#1276812).
  • CVE-2026-40017: CPU DoS via CRC32 hash collision in strmap (bsc#1276813).
  • CVE-2026-40018: MySQL multi-byte escaping performed incorrectly (bsc#1276810).
  • CVE-2026-40203: IMAP compression can reveal whether a small synced email body matches sender-chosen text (bsc#1276815).
  • CVE-2026-40204: lda_mailbox_autocreate can bypass ACL restrictions (bsc#1276819).
  • CVE-2026-40205: OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path (bsc#1276820).
  • CVE-2026-42007: sieve editheader RCE (bsc#1276817).
  • CVE-2026-42008: XCLIENT FORWARD= bare token not namespaced (bsc#1276824).
  • CVE-2026-42391: imap: pre-login memory/CPU growth with ID command (bsc#1276835).
  • CVE-2026-42392: imap-urlauth leaks memory into user-visible error messages (bsc#1276829).
  • CVE-2026-42393: doveadm_password or api key length can be leaked with timing comparisons (bsc#1276827).
  • CVE-2026-52687: imap: COMPRESS ZSTD can cause excessive memory usage (bsc#1276837).
  • CVE-2026-42395: single NUL-byte XCLIENT FORWARD payload crashes (bsc#1276826).
  • CVE-2026-52681: sieve resource usage tracking lost when active script changes (bsc#1276828).
  • CVE-2026-73208: auth: db-oauth2: aud claim used as fallback for missing scope claim (bsc#1276830).
  • CVE-2026-73209: imap-login crash due to self-recursion on zero-output decompress chunks (bsc#1276833).
Record
openSUSE-SU-2026:21720-1
Updated
2026-11-02
OSVSUSE-SU-2026:23595-1 No score

Security update for dovecot24

This update for dovecot24 fixes the following issues:

Update to 2.4.5.

  • CVE-2026-33263: submission-login: panic when mail_max_userip_connections is reached (bsc#1276794).
  • CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799).
  • CVE-2026-33604: SMTP smuggling via missing dot-stuffing after bare carriage return (bsc#1276802).
  • CVE-2026-33605: managesieve-login: pre-auth crash (bsc#1276809).
  • CVE-2026-33606: dsync: mail content can cause dsync protocol injection (bsc#1276800).
  • CVE-2026-33607: IMAP LIST match_sub() exponential backtracking leading to CPU denial of service (bsc#1276795).
  • CVE-2026-40013: stack buffer underflow in pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT (bsc#1276807).
  • CVE-2026-40014: CPU DoS via crafted references header (bsc#1276804).
  • CVE-2026-40015: imap-hibernate can be crashed (bsc#1276812).
  • CVE-2026-40017: CPU DoS via CRC32 hash collision in strmap (bsc#1276813).
  • CVE-2026-40018: MySQL multi-byte escaping performed incorrectly (bsc#1276810).
  • CVE-2026-40203: IMAP compression can reveal whether a small synced email body matches sender-chosen text (bsc#1276815).
  • CVE-2026-40204: lda_mailbox_autocreate can bypass ACL restrictions (bsc#1276819).
  • CVE-2026-40205: OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path (bsc#1276820).
  • CVE-2026-42007: sieve editheader RCE (bsc#1276817).
  • CVE-2026-42008: XCLIENT FORWARD= bare token not namespaced (bsc#1276824).
  • CVE-2026-42391: imap: pre-login memory/CPU growth with ID command (bsc#1276835).
  • CVE-2026-42392: imap-urlauth leaks memory into user-visible error messages (bsc#1276829).
  • CVE-2026-42393: doveadm_password or api key length can be leaked with timing comparisons (bsc#1276827).
  • CVE-2026-52687: imap: COMPRESS ZSTD can cause excessive memory usage (bsc#1276837).
  • CVE-2026-42395: single NUL-byte XCLIENT FORWARD payload crashes (bsc#1276826).
  • CVE-2026-52681: sieve resource usage tracking lost when active script changes (bsc#1276828).
  • CVE-2026-73208: auth: db-oauth2: aud claim used as fallback for missing scope claim (bsc#1276830).
  • CVE-2026-73209: imap-login crash due to self-recursion on zero-output decompress chunks (bsc#1276833).
Record
SUSE-SU-2026:23595-1
Updated
2026-11-02
OSVSUSE-SU-2026:4139-1 No score

Security update for dovecot23

This update for dovecot23 fixes the following issues:

  • CVE-2024-23184: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive (bsc#1229184).
  • CVE-2024-23185: large headers can cause resource exhaustion when parsing message (bsc#1229183).
  • CVE-2025-59028: Invalid base64 authentication can cause DoS for other logins (bsc#1260894).
  • CVE-2025-59031: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing (bsc#1260895).
  • CVE-2025-59032: pigeonhole: ManageSieve panic occurs with sieve-connect as a client (bsc#1260902).
  • CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799).
  • CVE-2026-27855: OTP driver vulnerable to replay attack (bsc#1260900).
  • CVE-2026-27856: Doveadm credentials were not checked using timing-safe checking function (bsc#1260899).
  • CVE-2026-27857: sending excessive parenthesis causes imap-login to use excessive memory (bsc#1260898).
  • CVE-2026-27858: pigeonhole: managesieve-login can allocate large amount of memory during authentication (bsc#1260901).
  • CVE-2026-27859: excessive RFC 2231 MIME parameters in email would can excessive CPU usage (bsc#1260897).
  • CVE-2026-33263: submission-login: Panic when mail_max_userip_connections is reached (bsc#1276794).
  • CVE-2026-33603: login: base64 input can contain tabs that bypass IPC protection (bsc#1265147).
  • CVE-2026-33604: SMTP Smuggling via Missing Dot-Stuffing (bsc#1276802).
  • CVE-2026-33605: managesieve-login: Pre-auth crash (bsc#1276809).
  • CVE-2026-33606: dsync: Mail content can cause dsync protocol injection (bsc#1276800).
  • CVE-2026-33607: IMAP LIST match_sub() Exponential Backtracking -- CPU Denial of Service (bsc#1276795).
  • CVE-2026-40014: CPU DoS via Crafted References Header (bsc#1276804).
  • CVE-2026-40015: imap-hibernate can be crashed (bsc#1276812).
  • CVE-2026-40016: Sieve :contains/:matches O(NxM) substring match bypasses sieve_max_cpu_time limit (bsc#1265148).
  • CVE-2026-40019: managesieve-login pre-auth infinite loop (bsc#1276811).
  • CVE-2026-40020: IMAP folders can be shared-spammed to everyone (bsc#1265149).
  • CVE-2026-40203: IMAP Compression Can Reveal Whether a Small Synced Email Body Matches Sender-Chosen Text (bsc#1276815).
  • CVE-2026-40205: OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path (bsc#1276820).
  • CVE-2026-42006: imap-login: uncontrolled memory usage with excessive bracing over IMAP (bsc#1265150).
  • CVE-2026-42007: editheader RCE (bsc#1276817).
  • CVE-2026-42008: XCLIENT FORWARD= bare token not namespaced (bsc#1276824).
  • CVE-2026-42391: imap: Pre-login memory/CPU growth with ID command (bsc#1276835).
  • CVE-2026-42393: doveadm_password or api key length can still be leaked with timing comparisons (bsc#1276827).
  • CVE-2026-42395: Single NUL-Byte XCLIENT FORWARD Payload Crashes (bsc#1276826).
  • CVE-2026-52681: Sieve resource usage tracking lost when active script changes (bsc#1276828).
  • CVE-2026-52687: IMAP: COMPRESS ZSTD can cause excessive memory usage (bsc#1276837).
  • CVE-2026-73208: auth: db-oauth2: aud claim used as fallback for missing scope claim (bsc#1276830).
  • CVE-2026-73209: imap-login crash: Self-recursion on zero-output decompress chunks (bsc#1276833).

Changes for dovecot23:

  • Update to version 2.3.21.1.
Record
SUSE-SU-2026:4139-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dovecot
Azure Linux:3
 through 2.3.20-1 None known
dovecot
Debian:12
 before 1:2.3.19.1+dfsg1-2.1+deb12u7, plus listed versions
1:2.3.19.1+dfsg1-2.11:2.3.19.1+dfsg1-2.1+deb12u11:2.3.19.1+dfsg1-2.1+deb12u21:2.3.19.1+dfsg1-2.1+deb12u31:2.3.19.1+dfsg1-2.1+deb12u41:2.3.19.1+dfsg1-2.1+deb12u51:2.3.19.1+dfsg1-2.1+deb12u6
1:2.3.19.1+dfsg1-2.1+deb12u7
dovecot
Debian:13
 before 1:2.4.1+dfsg1-6+deb13u7, plus listed versions
1:2.4.1+dfsg1-61:2.4.1+dfsg1-6+deb13u11:2.4.1+dfsg1-6+deb13u21:2.4.1+dfsg1-6+deb13u31:2.4.1+dfsg1-6+deb13u41:2.4.1+dfsg1-6+deb13u51:2.4.1+dfsg1-6+deb13u6
1:2.4.1+dfsg1-6+deb13u7
dovecot
Debian:14
 before 1:2.4.5+dfsg1-1, plus listed versions
1:2.4.1+dfsg1-61:2.4.1+dfsg1-71:2.4.1+dfsg1-81:2.4.1+dfsg1-91:2.4.2+dfsg1-1
Show 7 moreShow less
1:2.4.2+dfsg1-21:2.4.2+dfsg1-31:2.4.2+dfsg1-41:2.4.3+dfsg1-11:2.4.3+dfsg1-21:2.4.4+dfsg1-11:2.4.4+dfsg1-2
1:2.4.5+dfsg1-1
dovecot
Mageia:10
 before 2.4.5-2.mga10
2.4.5-2.mga10
dovecot24
SUSE:Linux Enterprise Server 16.0
 before 2.4.4-160000.2.1
2.4.4-160000.2.1
dovecot24
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 2.4.4-160000.2.1
2.4.4-160000.2.1
dovecot23
SUSE:Linux Enterprise Module for Server Applications 15 SP7
 before 2.3.21.1-150200.76.1
2.3.21.1-150200.76.1
dovecot23
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 2.3.21.1-150200.76.1
2.3.21.1-150200.76.1
dovecot23
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 2.3.21.1-150200.76.1
2.3.21.1-150200.76.1
Show 16 moreShow less
Affected packages
PackageAffectedFixed
dovecot23
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 2.3.21.1-150200.76.1
2.3.21.1-150200.76.1
dovecot23
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 2.3.21.1-150200.76.1
2.3.21.1-150200.76.1
dovecot23
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 2.3.21.1-150200.76.1
2.3.21.1-150200.76.1
dovecot23
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 2.3.21.1-150200.76.1
2.3.21.1-150200.76.1
dovecot23
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 2.3.21.1-150200.76.1
2.3.21.1-150200.76.1
dovecot23
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 2.3.21.1-150200.76.1
2.3.21.1-150200.76.1
dovecot23
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 2.3.21.1-150200.76.1
2.3.21.1-150200.76.1
dovecot23
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 2.3.21.1-150200.76.1
2.3.21.1-150200.76.1
dovecot
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1:2.1.7-7ubuntu31:2.2.9-1ubuntu11:2.2.9-1ubuntu21:2.2.9-1ubuntu2.11:2.2.9-1ubuntu2.3
Show 7 moreShow less
1:2.2.9-1ubuntu2.41:2.2.9-1ubuntu2.51:2.2.9-1ubuntu2.61:2.2.9-1ubuntu2.6+esm11:2.2.9-1ubuntu2.6+esm21:2.2.9-1ubuntu2.6+esm31:2.2.9-1ubuntu2.6+esm4
 None known
dovecot
Ubuntu:16.04:LTS
 All versions, plus listed versions
1:2.2.18-2ubuntu21:2.2.22-1ubuntu11:2.2.22-1ubuntu21:2.2.22-1ubuntu2.11:2.2.22-1ubuntu2.2
Show 11 moreShow less
1:2.2.22-1ubuntu2.31:2.2.22-1ubuntu2.41:2.2.22-1ubuntu2.61:2.2.22-1ubuntu2.71:2.2.22-1ubuntu2.81:2.2.22-1ubuntu2.91:2.2.22-1ubuntu2.101:2.2.22-1ubuntu2.111:2.2.22-1ubuntu2.121:2.2.22-1ubuntu2.131:2.2.22-1ubuntu2.14
 None known
dovecot
Ubuntu:18.04:LTS
 All versions, plus listed versions
1:2.2.27-3ubuntu11:2.2.33.2-1ubuntu11:2.2.33.2-1ubuntu21:2.2.33.2-1ubuntu31:2.2.33.2-1ubuntu4
Show 8 moreShow less
1:2.2.33.2-1ubuntu4.11:2.2.33.2-1ubuntu4.21:2.2.33.2-1ubuntu4.31:2.2.33.2-1ubuntu4.41:2.2.33.2-1ubuntu4.51:2.2.33.2-1ubuntu4.61:2.2.33.2-1ubuntu4.71:2.2.33.2-1ubuntu4.8
 None known
dovecot
Ubuntu:20.04:LTS
 All versions, plus listed versions
1:2.3.4.1-5ubuntu31:2.3.7.2-1ubuntu11:2.3.7.2-1ubuntu21:2.3.7.2-1ubuntu31:2.3.7.2-1ubuntu3.1
Show 6 moreShow less
1:2.3.7.2-1ubuntu3.21:2.3.7.2-1ubuntu3.31:2.3.7.2-1ubuntu3.41:2.3.7.2-1ubuntu3.51:2.3.7.2-1ubuntu3.61:2.3.7.2-1ubuntu3.7
 None known
dovecot
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:2.3.13+dfsg1-1ubuntu31:2.3.16+dfsg1-3ubuntu11:2.3.16+dfsg1-3ubuntu21:2.3.16+dfsg1-3ubuntu2.11:2.3.16+dfsg1-3ubuntu2.2
Show 5 moreShow less
1:2.3.16+dfsg1-3ubuntu2.41:2.3.16+dfsg1-3ubuntu2.61:2.3.16+dfsg1-3ubuntu2.71:2.3.16+dfsg1-3ubuntu2.81:2.3.16+dfsg1-3ubuntu2.9
 None known
dovecot
Ubuntu:24.04:LTS
 All versions, plus listed versions
1:2.3.20+dfsg1-1ubuntu31:2.3.21+dfsg1-2ubuntu11:2.3.21+dfsg1-2ubuntu21:2.3.21+dfsg1-2ubuntu41:2.3.21+dfsg1-2ubuntu5
Show 6 moreShow less
1:2.3.21+dfsg1-2ubuntu61:2.3.21+dfsg1-2ubuntu6.11:2.3.21+dfsg1-2ubuntu6.21:2.3.21+dfsg1-2ubuntu6.31:2.3.21+dfsg1-2ubuntu6.41:2.3.21+dfsg1-2ubuntu6.5
 None known
dovecot
Ubuntu:26.04:LTS
 All versions, plus listed versions
1:2.4.1+dfsg1-5ubuntu41:2.4.1+dfsg1-5ubuntu51:2.4.2+dfsg1-3ubuntu11:2.4.2+dfsg1-3ubuntu21:2.4.2+dfsg1-3ubuntu2.1
 None known
dovecot24
openSUSE:Leap 16.0
 before 2.4.4-160000.2.1
2.4.4-160000.2.1

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-42008 is a medium vulnerability (CVSS 4.3) in Open-xchange Gmbh Ox Dovecot Ce, published August 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 14th percentile. Fixed in dovecot 1:2.3.19.1+dfsg1-2.1+deb12u7.

References

Show 84 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open