{"id":"CVE-2026-24031","aliases":["ALPINE-CVE-2026-24031","AZL-81698","DEBIAN-CVE-2026-24031","EUVD-2026-16561","GHSA-fx6f-5qgf-9fmx","SUSE-SU-2026:21208-1","UBUNTU-CVE-2026-24031","openSUSE-SU-2026:10442-1","openSUSE-SU-2026:20554-1"],"status":"published","title":"Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin....","description":"Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00402,"percentile":0.34717,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-89"],"published":"2026-03-27T00:00:00Z","modified":"2026-11-05T05:36:30Z","exploits":[{"source":"pocgithub","id":"aramosf/CVE-2026-24031","title":"aramosf/CVE-2026-24031","date":"2026-08-12","url":"https://github.com/aramosf/CVE-2026-24031"}],"fixes":[{"ecosystem":"Alpine:v3.23","package":"dovecot","fixed_in":["2.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"dovecot","fixed_in":["2.4.3-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dovecot","fixed_in":["1:2.4.1+dfsg1-6+deb13u4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dovecot","fixed_in":["1:2.4.3+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"dovecot","fixed_in":["1:2.4.1+dfsg1-5ubuntu4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.20-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.1+dfsg1-6+deb13u4"}]}],"versions":["1:2.4.1+dfsg1-6","1:2.4.1+dfsg1-6+deb13u1","1:2.4.1+dfsg1-6+deb13u2","1:2.4.1+dfsg1-6+deb13u3"]},{"source":"osv","ecosystem":"Debian:14","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.3+dfsg1-1"}]}],"versions":["1:2.4.1+dfsg1-6","1:2.4.1+dfsg1-7","1:2.4.1+dfsg1-8","1:2.4.1+dfsg1-9","1:2.4.2+dfsg1-1","1:2.4.2+dfsg1-2","1:2.4.2+dfsg1-3","1:2.4.2+dfsg1-4"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.1+dfsg1-5ubuntu4.1"}]}],"versions":["1:2.3.21.1+dfsg1-1ubuntu2","1:2.4.1+dfsg1-5ubuntu1","1:2.4.1+dfsg1-5ubuntu3","1:2.4.1+dfsg1-5ubuntu4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-160000.1.1"}]}],"bundled":10}],"products":[{"vendor":"dovecot","product":"dovecot"},{"vendor":"open-xchange","product":"dovecot"},{"vendor":"open-xchange gmbh","product":"ox dovecot pro"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json","tags":["vendor-advisory","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-24031","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452181","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24031.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24031","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-fx6f-5qgf-9fmx"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-24031","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24031.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-24031","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621208-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1260893","tags":["report"]},{"url":"https://bugzilla.suse.com/1260894","tags":["report"]},{"url":"https://bugzilla.suse.com/1260895","tags":["report"]},{"url":"https://bugzilla.suse.com/1260896","tags":["report"]},{"url":"https://bugzilla.suse.com/1260897","tags":["report"]},{"url":"https://bugzilla.suse.com/1260898","tags":["report"]},{"url":"https://bugzilla.suse.com/1260899","tags":["report"]},{"url":"https://bugzilla.suse.com/1260900","tags":["report"]},{"url":"https://bugzilla.suse.com/1260901","tags":["report"]},{"url":"https://bugzilla.suse.com/1260902","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27860","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-24031","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-24031","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8136-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-24031","description":"Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.","status":"published","published":"2026-03-27T08:10:18.1Z","modified":"2026-07-15T01:17:37.386Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"cna"},{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-89","CWE-89"],"updated_at":"2026-11-02T14:19:50.92611Z"}],"euvd":[{"id":"EUVD-2026-16561","description":"Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.","status":"published","published":"2026-03-27T08:10:18Z","modified":"2026-07-15T01:17:37Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T18:19:55.318488Z"}],"ghsa":[{"id":"GHSA-fx6f-5qgf-9fmx","title":"Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin....","description":"Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.","status":"published","published":"2026-03-27T09:31:18Z","modified":"2026-06-30T03:36:03Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:09:04.668745Z"}],"nvd":[{"id":"CVE-2026-24031","description":"Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.","status":"published","published":"2026-03-27T09:16:19.447Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:11.678711Z"}],"osv":[{"id":"ALPINE-CVE-2026-24031","description":"Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.","status":"published","published":"2026-03-27T09:16:19.447Z","modified":"2026-10-01T02:17:49.21265648Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"CVE-2026-24031","description":"Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.","status":"published","published":"2026-03-27T08:10:18.1Z","modified":"2026-10-28T02:31:10.484172979Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:44:59.079784Z"},{"id":"DEBIAN-CVE-2026-24031","description":"Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.","status":"published","published":"2026-03-27T09:16:19.447Z","modified":"2026-10-27T09:47:32.257476306Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"UBUNTU-CVE-2026-24031","description":"Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.","status":"published","published":"2026-03-27T00:00:00Z","modified":"2026-06-30T18:17:39.2974433Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high"},{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"AZL-81698","title":"CVE-2026-24031 affecting package dovecot 2.3.20-1","description":"Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.","status":"published","published":"2026-03-27T09:16:19Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.988217Z"},{"id":"openSUSE-SU-2026:10442-1","title":"dovecot24-2.4.3-1.1 on GA media","description":"These are all security issues fixed in the dovecot24-2.4.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-27T00:00:00Z","modified":"2026-03-28T08:45:58.692143Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20554-1","title":"Security update for dovecot24","description":"This update for dovecot24 fixes the following issues:\n\n- Update to v2.4.3\n- CVE-2025-59028: Invalid base64 authentication can cause DoS for other logins (bsc#1260894).\n- CVE-2025-59031: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing\n  (bsc#1260895).\n- CVE-2025-59032: pigeonhole: ManageSieve panic occurs with sieve-connect as a client (bsc#1260902).\n- CVE-2026-24031: SQL injection possible if auth_username_chars is configured empty. Fixed escaping to always happen.\n  v2.4 regression (bsc#1260896).\n- CVE-2026-27855: OTP driver vulnerable to replay attack (bsc#1260900).\n- CVE-2026-27856: Doveadm credentials were not checked using timing-safe checking function (bsc#1260899).\n- CVE-2026-27857: sending excessive parenthesis causes imap-login to use excessive memory (bsc#1260898).\n- CVE-2026-27858: pigeonhole: managesieve-login can allocate large amount of memory during authentication (bsc#1260901).\n- CVE-2026-27859: excessive RFC 2231 MIME parameters in email would can excessive CPU usage (bsc#1260897).\n- CVE-2026-27860: LDAP query injection possible if auth_username_chars is configured empty. Fixed escaping to always\n  happen. v2.4 regression (bsc#1260893).\n","status":"published","published":"2026-04-16T13:10:27Z","modified":"2026-04-22T18:27:08.975719Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:21208-1","title":"Security update for dovecot24","description":"This update for dovecot24 fixes the following issues:\n\n- Update to v2.4.3\n- CVE-2025-59028: Invalid base64 authentication can cause DoS for other logins (bsc#1260894).\n- CVE-2025-59031: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing\n  (bsc#1260895).\n- CVE-2025-59032: pigeonhole: ManageSieve panic occurs with sieve-connect as a client (bsc#1260902).\n- CVE-2026-24031: SQL injection possible if auth_username_chars is configured empty. Fixed escaping to always happen.\n  v2.4 regression (bsc#1260896).\n- CVE-2026-27855: OTP driver vulnerable to replay attack (bsc#1260900).\n- CVE-2026-27856: Doveadm credentials were not checked using timing-safe checking function (bsc#1260899).\n- CVE-2026-27857: sending excessive parenthesis causes imap-login to use excessive memory (bsc#1260898).\n- CVE-2026-27858: pigeonhole: managesieve-login can allocate large amount of memory during authentication (bsc#1260901).\n- CVE-2026-27859: excessive RFC 2231 MIME parameters in email would can excessive CPU usage (bsc#1260897).\n- CVE-2026-27860: LDAP query injection possible if auth_username_chars is configured empty. Fixed escaping to always\n  happen. v2.4 regression (bsc#1260893).\n","status":"published","published":"2026-04-16T13:15:05Z","modified":"2026-04-22T18:26:16.302742Z","updated_at":"2026-11-02T15:54:02.312556Z"}]}}