CVE-2020-10957

In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command...

7.5 HighFix available

In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

7.17%Up 4.9 points since Apr 14, 2021

What each source reports

CVE List Score used 7.5

In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp.

Record: CVE-2020-10957
CVSS 3.0: 7.5 HighCVSS:3.0/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N
Updated: 2026-11-02

EUVDEUVD-2020-3361 7.5

In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp.

Record: EUVD-2020-3361
CVSS 3.0: 7.5 HighCVSS:3.0/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-q55g-848v-f654 No score

In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command...

In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp.

Record: GHSA-q55g-848v-f654
Updated: 2026-11-02

NVD 7.5

In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp.

Record: CVE-2020-10957
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-476
Updated: 2026-11-02

OSVALPINE-CVE-2020-10957 7.5

In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp.

Record: ALPINE-CVE-2020-10957
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 7.5

In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp.

Record: CVE-2020-10957
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 10 moreShow less

OSVDEBIAN-CVE-2020-10957 7.5

In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp.

Record: DEBIAN-CVE-2020-10957
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2020:2901 7.5

Red Hat Security Advisory: dovecot security update

Record: RHSA-2020:2901
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2020-10957 7.5

In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp.

Record: UBUNTU-CVE-2020-10957
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2020-0222 No score

Updated dovecot packages fix security vulnerabilities

Dovecot has been updated to fix several security issues.

Sending malformed NOOP command causes crash in submission, submission-login or lmtp service (CVE-2020-10957).

Sending command followed by sufficient number of newlines triggers a use-after-free bug that might crash submission-login, submission or lmtp service (CVE-2020-10958).

Sending mail with empty quoted localpart causes submission or lmtp component to crash (CVE-2020-10967).

Record: MGASA-2020-0222
Updated: 2026-11-02

OSVopenSUSE-SU-2020:0720-1 No score

Security update for dovecot23

This update for dovecot23 to 2.3.10 fixes the following issues:

Security issues fixed:

CVE-2020-10957: Fixed a crash caused by malformed NOOP commands (bsc#1171457).
CVE-2020-10958: Fixed a use-after-free when receiving too many newlines (bsc#1171458).
CVE-2020-10967: Fixed a crash in the lmtp and submission components caused by mails with empty quoted localparts (bsc#1171456).

Non-security issues fixed:

The update to 2.3.10 fixes several bugs. Please refer to https://dovecot.org/doc/NEWS for a complete list of changes.

This update was imported from the SUSE:SLE-15-SP1:Update update project.

Record: openSUSE-SU-2020:0720-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10726-1 No score

dovecot23-2.3.16-1.6 on GA media

These are all security issues fixed in the dovecot23-2.3.16-1.6 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10726-1
Updated: 2026-11-02

OSVopenSUSE-SU-2025:14715-1 No score

dovecot24-2.4.0-1.1 on GA media

These are all security issues fixed in the dovecot24-2.4.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2025:14715-1
Updated: 2026-11-02

OSVSUSE-SU-2020:1379-1 No score

Security update for dovecot23

This update for dovecot23 fixes the following issues:

Security issues fixed:

CVE-2020-10957: Fixed a crash caused by malformed NOOP commands (bsc#1171457).
CVE-2020-10958: Fixed a use-after-free when receiving too many newlines (bsc#1171458).
CVE-2020-10967: Fixed a crash in the lmtp and submission components caused by mails with empty quoted localparts (bsc#1171456).

Non-security issues fixed:

The update to 2.3.10 fixes several bugs. Please refer to https://dovecot.org/doc/NEWS for a complete list of changes.

Record: SUSE-SU-2020:1379-1
Updated: 2026-11-02

OSVSUSE-SU-2020:1380-1 No score

Security update for dovecot23

This update for dovecot23 to 2.3.10 fixes the following issues:

Security issues fixed:

CVE-2020-10957: Fixed a crash caused by malformed NOOP commands (bsc#1171457).
CVE-2020-10958: Fixed a use-after-free when receiving too many newlines (bsc#1171458).
CVE-2020-10967: Fixed a crash in the lmtp and submission components caused by mails with empty quoted localparts (bsc#1171456).

Non-security issues fixed:

The update to 2.3.10 fixes several bugs. Please refer to https://dovecot.org/doc/NEWS for a complete list of changes.

Record: SUSE-SU-2020:1380-1
Updated: 2026-11-02

OSVUSN-4361-1 No score

dovecot vulnerabilities

Philippe Antoine discovered that Dovecot incorrectly handled certain data. An attacker could possibly use this issue to cause a denial of service. (CVE-2020-10957, CVE-2020-10967)

Philippe Antoine discovered that Dovecot incorrectly handled certain data. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2020-10958)

Record: USN-4361-1
Updated: 2026-11-02

Affected products

dovecot

Affected packages

Affected packages
Package	Affected	Fixed
`dovecot` Alpine:v3.10	before 2.3.10.1-r0	2.3.10.1-r0
`dovecot` Alpine:v3.11	before 2.3.10.1-r0	2.3.10.1-r0
`dovecot` Alpine:v3.12	before 2.3.10.1-r0	2.3.10.1-r0
`dovecot` Alpine:v3.13	before 2.3.10.1-r0	2.3.10.1-r0
`dovecot` Alpine:v3.14	before 2.3.10.1-r0	2.3.10.1-r0
`dovecot` Alpine:v3.15	before 2.3.10.1-r0	2.3.10.1-r0
`dovecot` Alpine:v3.16	before 2.3.10.1-r0	2.3.10.1-r0
`dovecot` Alpine:v3.17	before 2.3.10.1-r0	2.3.10.1-r0
`dovecot` Alpine:v3.18	before 2.3.10.1-r0	2.3.10.1-r0
`dovecot` Alpine:v3.19	before 2.3.10.1-r0	2.3.10.1-r0

Show 38 moreShow less

Affected packages
Package	Affected	Fixed
`dovecot` Alpine:v3.20	before 2.3.10.1-r0	2.3.10.1-r0
`dovecot` Alpine:v3.21	before 2.3.10.1-r0	2.3.10.1-r0
`dovecot` Alpine:v3.22	before 2.3.10.1-r0	2.3.10.1-r0
`dovecot` Alpine:v3.23	before 2.3.10.1-r0	2.3.10.1-r0
`dovecot` Alpine:v3.24	before 2.3.10.1-r0	2.3.10.1-r0
`dovecot` Alpine:v3.8	before 2.3.10.1-r0	2.3.10.1-r0
`dovecot` Alpine:v3.9	before 2.3.10.1-r0	2.3.10.1-r0
`dovecot` Debian:12	before 1:2.3.10.1+dfsg1-1	1:2.3.10.1+dfsg1-1
`dovecot` Debian:13	before 1:2.3.10.1+dfsg1-1	1:2.3.10.1+dfsg1-1
`dovecot` Debian:14	before 1:2.3.10.1+dfsg1-1	1:2.3.10.1+dfsg1-1
`dovecot` Debian:10 From an advisory covering 3 CVEs	before 1:2.3.4.1-5+deb10u2, plus listed versions 1:2.3.4.1-51:2.3.4.1-5+deb10u11:2.3.4.1-5+deb10u1~bpo9+1	1:2.3.4.1-5+deb10u2
`dovecot` Mageia:7 From an advisory covering 3 CVEs	before 2.3.10.1-1.mga7	2.3.10.1-1.mga7
`dovecot` Red Hat:enterprise_linux:8::appstream	before 1:2.3.8-2.el8_2.1	1:2.3.8-2.el8_2.1
`dovecot-debuginfo` Red Hat:enterprise_linux:8::appstream	before 1:2.3.8-2.el8_2.1	1:2.3.8-2.el8_2.1
`dovecot-debugsource` Red Hat:enterprise_linux:8::appstream	before 1:2.3.8-2.el8_2.1	1:2.3.8-2.el8_2.1
`dovecot-mysql` Red Hat:enterprise_linux:8::appstream	before 1:2.3.8-2.el8_2.1	1:2.3.8-2.el8_2.1
`dovecot-mysql-debuginfo` Red Hat:enterprise_linux:8::appstream	before 1:2.3.8-2.el8_2.1	1:2.3.8-2.el8_2.1
`dovecot-pgsql` Red Hat:enterprise_linux:8::appstream	before 1:2.3.8-2.el8_2.1	1:2.3.8-2.el8_2.1
`dovecot-pgsql-debuginfo` Red Hat:enterprise_linux:8::appstream	before 1:2.3.8-2.el8_2.1	1:2.3.8-2.el8_2.1
`dovecot-pigeonhole` Red Hat:enterprise_linux:8::appstream	before 1:2.3.8-2.el8_2.1	1:2.3.8-2.el8_2.1
`dovecot-pigeonhole-debuginfo` Red Hat:enterprise_linux:8::appstream	before 1:2.3.8-2.el8_2.1	1:2.3.8-2.el8_2.1
`dovecot` Red Hat:enterprise_linux:8::crb	before 1:2.3.8-2.el8_2.1	1:2.3.8-2.el8_2.1
`dovecot-debuginfo` Red Hat:enterprise_linux:8::crb	before 1:2.3.8-2.el8_2.1	1:2.3.8-2.el8_2.1
`dovecot-debugsource` Red Hat:enterprise_linux:8::crb	before 1:2.3.8-2.el8_2.1	1:2.3.8-2.el8_2.1
`dovecot-devel` Red Hat:enterprise_linux:8::crb	before 1:2.3.8-2.el8_2.1	1:2.3.8-2.el8_2.1
`dovecot-mysql-debuginfo` Red Hat:enterprise_linux:8::crb	before 1:2.3.8-2.el8_2.1	1:2.3.8-2.el8_2.1
`dovecot-pgsql-debuginfo` Red Hat:enterprise_linux:8::crb	before 1:2.3.8-2.el8_2.1	1:2.3.8-2.el8_2.1
`dovecot-pigeonhole-debuginfo` Red Hat:enterprise_linux:8::crb	before 1:2.3.8-2.el8_2.1	1:2.3.8-2.el8_2.1
`dovecot23` SUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 3 CVEs	before 2.3.10-4.22.1	2.3.10-4.22.1
`dovecot23` SUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 3 CVEs	before 2.3.10-4.22.1	2.3.10-4.22.1
`dovecot23` SUSE:Linux Enterprise Server 15-LTSS From an advisory covering 3 CVEs	before 2.3.10-4.22.1	2.3.10-4.22.1
`dovecot23` SUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 3 CVEs	before 2.3.10-4.22.1	2.3.10-4.22.1
`dovecot23` SUSE:Linux Enterprise Module for Server Applications 15 SP1 From an advisory covering 3 CVEs	before 2.3.10-11.1	2.3.10-11.1
`dovecot` Ubuntu:20.04:LTS	before 1:2.3.7.2-1ubuntu3.1, plus listed versions 1:2.3.4.1-5ubuntu31:2.3.7.2-1ubuntu11:2.3.7.2-1ubuntu21:2.3.7.2-1ubuntu3	1:2.3.7.2-1ubuntu3.1
`dovecot` Ubuntu:20.04:LTS From an advisory covering 3 CVEs	before 1:2.3.7.2-1ubuntu3.1, plus listed versions 1:2.3.4.1-5ubuntu31:2.3.7.2-1ubuntu11:2.3.7.2-1ubuntu21:2.3.7.2-1ubuntu3	1:2.3.7.2-1ubuntu3.1
`dovecot23` openSUSE:Leap 15.1 From an advisory covering 3 CVEs	before 2.3.10-lp151.2.9.1	2.3.10-lp151.2.9.1
`dovecot23` openSUSE:Tumbleweed From an advisory covering 22 CVEs	before 2.3.16-1.6	2.3.16-1.6
`dovecot24` openSUSE:Tumbleweed From an advisory covering 24 CVEs	before 2.4.0-1.1	2.4.0-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-10957 is a high vulnerability (CVSS 7.5) in Dovecot, published May 18, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.17%, the 94th percentile. Fixed in dovecot 2.3.10.1-r0.

References

Show 53 moreShow less