CVE-2026-42394
No scoreFix available
[sieve: symlink traversal flaw could result in arbitrary file disclosure]
What each source reports
OSVUBUNTU-CVE-2026-42394 No score
[sieve: symlink traversal flaw could result in arbitrary file disclosure]
- Record
UBUNTU-CVE-2026-42394- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dovecotDebian:12 |
before 1:2.3.19.1+dfsg1-2.1+deb12u7, plus listed versions 1:2.3.19.1+dfsg1-2.11:2.3.19.1+dfsg1-2.1+deb12u11:2.3.19.1+dfsg1-2.1+deb12u21:2.3.19.1+dfsg1-2.1+deb12u31:2.3.19.1+dfsg1-2.1+deb12u41:2.3.19.1+dfsg1-2.1+deb12u51:2.3.19.1+dfsg1-2.1+deb12u6 |
1:2.3.19.1+dfsg1-2.1+deb12u7 |
dovecotDebian:13 |
before 1:2.4.1+dfsg1-6+deb13u7, plus listed versions 1:2.4.1+dfsg1-61:2.4.1+dfsg1-6+deb13u11:2.4.1+dfsg1-6+deb13u21:2.4.1+dfsg1-6+deb13u31:2.4.1+dfsg1-6+deb13u41:2.4.1+dfsg1-6+deb13u51:2.4.1+dfsg1-6+deb13u6 |
1:2.4.1+dfsg1-6+deb13u7 |
dovecotDebian:14 |
before 1:2.4.5+dfsg1-1, plus listed versions 1:2.4.1+dfsg1-61:2.4.1+dfsg1-71:2.4.1+dfsg1-81:2.4.1+dfsg1-91:2.4.2+dfsg1-1 Show 7 moreShow less1:2.4.2+dfsg1-21:2.4.2+dfsg1-31:2.4.2+dfsg1-41:2.4.3+dfsg1-11:2.4.3+dfsg1-21:2.4.4+dfsg1-11:2.4.4+dfsg1-2 |
1:2.4.5+dfsg1-1 |
dovecotUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1:2.1.7-7ubuntu31:2.2.9-1ubuntu11:2.2.9-1ubuntu21:2.2.9-1ubuntu2.11:2.2.9-1ubuntu2.3 Show 7 moreShow less1:2.2.9-1ubuntu2.41:2.2.9-1ubuntu2.51:2.2.9-1ubuntu2.61:2.2.9-1ubuntu2.6+esm11:2.2.9-1ubuntu2.6+esm21:2.2.9-1ubuntu2.6+esm31:2.2.9-1ubuntu2.6+esm4 |
None known |
dovecotUbuntu:16.04:LTS |
All versions, plus listed versions 1:2.2.18-2ubuntu21:2.2.22-1ubuntu11:2.2.22-1ubuntu21:2.2.22-1ubuntu2.11:2.2.22-1ubuntu2.2 Show 11 moreShow less1:2.2.22-1ubuntu2.31:2.2.22-1ubuntu2.41:2.2.22-1ubuntu2.61:2.2.22-1ubuntu2.71:2.2.22-1ubuntu2.81:2.2.22-1ubuntu2.91:2.2.22-1ubuntu2.101:2.2.22-1ubuntu2.111:2.2.22-1ubuntu2.121:2.2.22-1ubuntu2.131:2.2.22-1ubuntu2.14 |
None known |
dovecotUbuntu:18.04:LTS |
All versions, plus listed versions 1:2.2.27-3ubuntu11:2.2.33.2-1ubuntu11:2.2.33.2-1ubuntu21:2.2.33.2-1ubuntu31:2.2.33.2-1ubuntu4 Show 8 moreShow less1:2.2.33.2-1ubuntu4.11:2.2.33.2-1ubuntu4.21:2.2.33.2-1ubuntu4.31:2.2.33.2-1ubuntu4.41:2.2.33.2-1ubuntu4.51:2.2.33.2-1ubuntu4.61:2.2.33.2-1ubuntu4.71:2.2.33.2-1ubuntu4.8 |
None known |
dovecotUbuntu:20.04:LTS |
All versions, plus listed versions 1:2.3.4.1-5ubuntu31:2.3.7.2-1ubuntu11:2.3.7.2-1ubuntu21:2.3.7.2-1ubuntu31:2.3.7.2-1ubuntu3.1 Show 6 moreShow less1:2.3.7.2-1ubuntu3.21:2.3.7.2-1ubuntu3.31:2.3.7.2-1ubuntu3.41:2.3.7.2-1ubuntu3.51:2.3.7.2-1ubuntu3.61:2.3.7.2-1ubuntu3.7 |
None known |
dovecotUbuntu:22.04:LTS |
All versions, plus listed versions 1:2.3.13+dfsg1-1ubuntu31:2.3.16+dfsg1-3ubuntu11:2.3.16+dfsg1-3ubuntu21:2.3.16+dfsg1-3ubuntu2.11:2.3.16+dfsg1-3ubuntu2.2 Show 5 moreShow less1:2.3.16+dfsg1-3ubuntu2.41:2.3.16+dfsg1-3ubuntu2.61:2.3.16+dfsg1-3ubuntu2.71:2.3.16+dfsg1-3ubuntu2.81:2.3.16+dfsg1-3ubuntu2.9 |
None known |
dovecotUbuntu:24.04:LTS |
All versions, plus listed versions 1:2.3.20+dfsg1-1ubuntu31:2.3.21+dfsg1-2ubuntu11:2.3.21+dfsg1-2ubuntu21:2.3.21+dfsg1-2ubuntu41:2.3.21+dfsg1-2ubuntu5 Show 6 moreShow less1:2.3.21+dfsg1-2ubuntu61:2.3.21+dfsg1-2ubuntu6.11:2.3.21+dfsg1-2ubuntu6.21:2.3.21+dfsg1-2ubuntu6.31:2.3.21+dfsg1-2ubuntu6.41:2.3.21+dfsg1-2ubuntu6.5 |
None known |
dovecotUbuntu:26.10 |
All versions, plus listed versions 1:2.4.2+dfsg1-3ubuntu21:2.4.2+dfsg1-3ubuntu31:2.4.4+dfsg1-2ubuntu11:2.4.4+dfsg1-2ubuntu21:2.4.4+dfsg1-2ubuntu41:2.4.4+dfsg1-2ubuntu5 |
None known |
dovecotUbuntu:26.04:LTS |
All versions, plus listed versions 1:2.4.1+dfsg1-5ubuntu41:2.4.1+dfsg1-5ubuntu51:2.4.2+dfsg1-3ubuntu11:2.4.2+dfsg1-3ubuntu21:2.4.2+dfsg1-3ubuntu2.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-42394 is a vulnerability with no CVSS score yet in dovecot, published September 24, 2026. No source lists public exploit code. Fixed in dovecot 1:2.3.19.1+dfsg1-2.1+deb12u7.