{"id":"CVE-2026-27851","aliases":["ALPINE-CVE-2026-27851","AZL-86799","DEBIAN-CVE-2026-27851","EUVD-2026-29467","GHSA-xfpv-rrgm-4qqr","SUSE-SU-2026:22185-1","UBUNTU-CVE-2026-27851","USN-8365-1","openSUSE-SU-2026:10766-1","openSUSE-SU-2026:21109-1"],"status":"published","title":"When safe filter is used with variable expansion, all following pipelines on the same string are...","description":"When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00406,"percentile":0.35324,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-235","CWE-89"],"published":"2026-05-12T13:28:43Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"dovecot","fixed_in":["2.4.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"dovecot","fixed_in":["2.4.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dovecot","fixed_in":["1:2.4.1+dfsg1-6+deb13u6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dovecot","fixed_in":["1:2.4.4+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"dovecot","fixed_in":["1:2.4.1+dfsg1-5ubuntu4.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"dovecot","fixed_in":["1:2.4.2+dfsg1-3ubuntu2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"dovecot","fixed_in":["1:2.3.16+dfsg1-3ubuntu2.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"dovecot","fixed_in":["1:2.3.21+dfsg1-2ubuntu6.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.20-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.1+dfsg1-6+deb13u6"}]}],"versions":["1:2.4.1+dfsg1-6","1:2.4.1+dfsg1-6+deb13u1","1:2.4.1+dfsg1-6+deb13u2","1:2.4.1+dfsg1-6+deb13u3","1:2.4.1+dfsg1-6+deb13u4","1:2.4.1+dfsg1-6+deb13u5"]},{"source":"osv","ecosystem":"Debian:14","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.4+dfsg1-1"}]}],"versions":["1:2.4.1+dfsg1-6","1:2.4.1+dfsg1-7","1:2.4.1+dfsg1-8","1:2.4.1+dfsg1-9","1:2.4.2+dfsg1-1","1:2.4.2+dfsg1-2","1:2.4.2+dfsg1-3","1:2.4.2+dfsg1-4","1:2.4.3+dfsg1-1","1:2.4.3+dfsg1-2"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-160000.1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-160000.1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.1+dfsg1-5ubuntu4.2"}]}],"versions":["1:2.3.21.1+dfsg1-1ubuntu2","1:2.4.1+dfsg1-5ubuntu1","1:2.4.1+dfsg1-5ubuntu3","1:2.4.1+dfsg1-5ubuntu4","1:2.4.1+dfsg1-5ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.2+dfsg1-3ubuntu2.1"}]}],"versions":["1:2.4.1+dfsg1-5ubuntu4","1:2.4.1+dfsg1-5ubuntu5","1:2.4.2+dfsg1-3ubuntu1","1:2.4.2+dfsg1-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16+dfsg1-3ubuntu2.9"}]}],"versions":["1:2.3.13+dfsg1-1ubuntu3","1:2.3.16+dfsg1-3ubuntu1","1:2.3.16+dfsg1-3ubuntu2","1:2.3.16+dfsg1-3ubuntu2.1","1:2.3.16+dfsg1-3ubuntu2.2","1:2.3.16+dfsg1-3ubuntu2.4","1:2.3.16+dfsg1-3ubuntu2.6","1:2.3.16+dfsg1-3ubuntu2.7","1:2.3.16+dfsg1-3ubuntu2.8"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21+dfsg1-2ubuntu6.5"}]}],"versions":["1:2.3.20+dfsg1-1ubuntu3","1:2.3.21+dfsg1-2ubuntu1","1:2.3.21+dfsg1-2ubuntu2","1:2.3.21+dfsg1-2ubuntu4","1:2.3.21+dfsg1-2ubuntu5","1:2.3.21+dfsg1-2ubuntu6","1:2.3.21+dfsg1-2ubuntu6.1","1:2.3.21+dfsg1-2ubuntu6.2","1:2.3.21+dfsg1-2ubuntu6.3","1:2.3.21+dfsg1-2ubuntu6.4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.1+dfsg1-5ubuntu4.2"}]}],"versions":["1:2.3.21.1+dfsg1-1ubuntu2","1:2.4.1+dfsg1-5ubuntu1","1:2.4.1+dfsg1-5ubuntu3","1:2.4.1+dfsg1-5ubuntu4","1:2.4.1+dfsg1-5ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.2+dfsg1-3ubuntu2.1"}]}],"versions":["1:2.4.1+dfsg1-5ubuntu4","1:2.4.1+dfsg1-5ubuntu5","1:2.4.2+dfsg1-3ubuntu1","1:2.4.2+dfsg1-3ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-160000.1.1"}]}],"bundled":5}],"products":[{"vendor":"dovecot","product":"dovecot"},{"vendor":"open-xchange","product":"dovecot"},{"vendor":"open-xchange gmbh","product":"ox dovecot pro"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json","tags":["vendor-advisory","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27851","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476471","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27851.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27851","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-xfpv-rrgm-4qqr"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-27851","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27851.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-27851","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622185-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1265146","tags":["report"]},{"url":"https://bugzilla.suse.com/1265147","tags":["report"]},{"url":"https://bugzilla.suse.com/1265148","tags":["report"]},{"url":"https://bugzilla.suse.com/1265149","tags":["report"]},{"url":"https://bugzilla.suse.com/1265150","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42006","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-27851","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27851","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/12/6","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8365-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-33603","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40016","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40020","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-42006","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-27851","description":"When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.","status":"published","published":"2026-05-12T13:28:43.846Z","modified":"2026-07-15T01:12:53.011Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-235","CWE-89"],"updated_at":"2026-11-02T14:19:48.826324Z"}],"euvd":[{"id":"EUVD-2026-29467","description":"When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.","status":"published","published":"2026-05-12T13:28:43Z","modified":"2026-07-15T01:12:53Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:19:55.842782Z"}],"ghsa":[{"id":"GHSA-xfpv-rrgm-4qqr","title":"When safe filter is used with variable expansion, all following pipelines on the same string are...","description":"When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.","status":"published","published":"2026-05-12T15:31:40Z","modified":"2026-06-30T03:36:39Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-89","CWE-235"],"updated_at":"2026-11-02T15:09:05.34707Z"}],"nvd":[{"id":"CVE-2026-27851","description":"When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.","status":"published","published":"2026-05-12T14:16:56.857Z","modified":"2026-10-26T18:10:00.173Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-235","CWE-89"],"updated_at":"2026-11-02T14:12:18.613259Z"}],"osv":[{"id":"ALPINE-CVE-2026-27851","description":"When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.","status":"published","published":"2026-05-12T14:16:56.857Z","modified":"2026-10-01T02:17:49.223936199Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"CVE-2026-27851","description":"When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.","status":"published","published":"2026-05-12T13:28:43.846Z","modified":"2026-10-28T02:30:30.503234538Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-235"],"updated_at":"2026-11-02T15:45:00.180685Z"},{"id":"DEBIAN-CVE-2026-27851","description":"When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.","status":"published","published":"2026-05-12T14:16:56.857Z","modified":"2026-10-27T09:47:41.471942312Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"UBUNTU-CVE-2026-27851","description":"When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.","status":"published","published":"2026-05-12T14:16:00Z","modified":"2026-06-30T18:17:44.367409541Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"AZL-86799","title":"CVE-2026-27851 affecting package dovecot 2.3.20-1","description":"When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.","status":"published","published":"2026-05-12T14:16:56Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:25.190302Z"},{"id":"openSUSE-SU-2026:10766-1","title":"dovecot24-2.4.4-1.1 on GA media","description":"These are all security issues fixed in the dovecot24-2.4.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-13T00:00:00Z","modified":"2026-05-14T08:16:24.20474Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:21109-1","title":"Security update for dovecot24","description":"This update for dovecot24 fixes the following issues\n\n- CVE-2026-27851: lib-var-expand: safe filter leaks to all following pipelines (bsc#1265146).\n- CVE-2026-33603: login: base64 input can contain tabs that bypass IPC protection (bsc#1265147).\n- CVE-2026-40016: Sieve: contains/: matches O(NxM) substring match bypasses sieve_max_cpu_time limit (bsc#1265148).\n- CVE-2026-40020: IMAP folders can be shared-spammed to everyone (bsc#1265149).\n- CVE-2026-42006: imap-login: uncontrolled memory usage with excessive bracing over IMAP (bsc#1265150).\n\nChanges for dovecot24:\n\n- Update to 2.4.4\n","status":"published","published":"2026-06-19T17:08:41Z","modified":"2026-06-30T18:24:42.024781248Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22185-1","title":"Security update for dovecot24","description":"This update for dovecot24 fixes the following issues\n\n- CVE-2026-27851: lib-var-expand: safe filter leaks to all following pipelines (bsc#1265146).\n- CVE-2026-33603: login: base64 input can contain tabs that bypass IPC protection (bsc#1265147).\n- CVE-2026-40016: Sieve: contains/: matches O(NxM) substring match bypasses sieve_max_cpu_time limit (bsc#1265148).\n- CVE-2026-40020: IMAP folders can be shared-spammed to everyone (bsc#1265149).\n- CVE-2026-42006: imap-login: uncontrolled memory usage with excessive bracing over IMAP (bsc#1265150).\n\nChanges for dovecot24:\n\n- Update to 2.4.4\n","status":"published","published":"2026-06-19T17:04:26Z","modified":"2026-06-24T18:24:19.457547599Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"USN-8365-1","title":"dovecot vulnerabilities","description":"It was discovered that Dovecot incorrectly treated some variable expansion\npipelines as safe in authentication filters. An attacker could possibly use\nthis issue to perform SQL or LDAP injection attacks. This issue only\naffected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-27851)\n\nIt was discovered that Dovecot incorrectly verified SCRAM TLS channel\nbinding in certain base64 exchanges. A remote attacker could possibly use\nthis issue to obtain sensitive information in a machine-in-the-middle\nattack. (CVE-2026-33603)\n\nIt was discovered that Dovecot incorrectly enforced Sieve script CPU\nlimits. An attacker could possibly use this issue to cause Dovecot to use\nexcessive resources, leading to a denial of service. (CVE-2026-40016)\n\nIt was discovered that Dovecot incorrectly handled certain IMAP SETACL\ncommands. An attacker could possibly use this issue to spam folders to\nother users. (CVE-2026-40020)\n\nIt was discovered that Dovecot incorrectly handled excessive IMAP bracing.\nAn attacker could possibly use this issue to cause Dovecot to use excessive\nresources, leading to a denial of service. (CVE-2026-42006)","status":"published","published":"2026-06-02T12:42:17Z","modified":"2026-06-30T18:16:45.062183426Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}