{"id":"CVE-2026-27860","aliases":["ALPINE-CVE-2026-27860","AZL-81716","DEBIAN-CVE-2026-27860","EUVD-2026-16573","GHSA-3322-wpc2-p4m7","SUSE-SU-2026:21208-1","UBUNTU-CVE-2026-27860","openSUSE-SU-2026:10442-1","openSUSE-SU-2026:20554-1"],"status":"published","title":"If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP...","description":"If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out auth_username_chars, or install fixed version. No publicly available exploits are known.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00297,"percentile":0.22658,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-90"],"published":"2026-03-27T00:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"dovecot","fixed_in":["2.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"dovecot","fixed_in":["2.4.3-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dovecot","fixed_in":["1:2.4.1+dfsg1-6+deb13u4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dovecot","fixed_in":["1:2.4.3+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"dovecot","fixed_in":["1:2.4.1+dfsg1-5ubuntu4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.20-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.1+dfsg1-6+deb13u4"}]}],"versions":["1:2.4.1+dfsg1-6","1:2.4.1+dfsg1-6+deb13u1","1:2.4.1+dfsg1-6+deb13u2","1:2.4.1+dfsg1-6+deb13u3"]},{"source":"osv","ecosystem":"Debian:14","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.3+dfsg1-1"}]}],"versions":["1:2.4.1+dfsg1-6","1:2.4.1+dfsg1-7","1:2.4.1+dfsg1-8","1:2.4.1+dfsg1-9","1:2.4.2+dfsg1-1","1:2.4.2+dfsg1-2","1:2.4.2+dfsg1-3","1:2.4.2+dfsg1-4"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.1+dfsg1-5ubuntu4.1"}]}],"versions":["1:2.3.21.1+dfsg1-1ubuntu2","1:2.4.1+dfsg1-5ubuntu1","1:2.4.1+dfsg1-5ubuntu3","1:2.4.1+dfsg1-5ubuntu4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-160000.1.1"}]}],"bundled":10}],"products":[{"vendor":"dovecot","product":"dovecot"},{"vendor":"open-xchange","product":"dovecot"},{"vendor":"open-xchange gmbh","product":"ox dovecot pro"}],"references":[{"url":"https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json","tags":["vendor-advisory","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27860","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-3322-wpc2-p4m7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-27860","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27860.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-27860","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621208-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1260893","tags":["report"]},{"url":"https://bugzilla.suse.com/1260894","tags":["report"]},{"url":"https://bugzilla.suse.com/1260895","tags":["report"]},{"url":"https://bugzilla.suse.com/1260896","tags":["report"]},{"url":"https://bugzilla.suse.com/1260897","tags":["report"]},{"url":"https://bugzilla.suse.com/1260898","tags":["report"]},{"url":"https://bugzilla.suse.com/1260899","tags":["report"]},{"url":"https://bugzilla.suse.com/1260900","tags":["report"]},{"url":"https://bugzilla.suse.com/1260901","tags":["report"]},{"url":"https://bugzilla.suse.com/1260902","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27860","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-27860","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27860","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8136-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-27860","description":"If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out auth_username_chars, or install fixed version. No publicly available exploits are known.","status":"published","published":"2026-03-27T08:10:22.695Z","modified":"2026-03-27T12:33:57.043Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-90"],"updated_at":"2026-11-02T14:19:49.199185Z"}],"euvd":[{"id":"EUVD-2026-16573","description":"If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out auth_username_chars, or install fixed version. No publicly available exploits are known.","status":"published","published":"2026-03-27T08:10:22Z","modified":"2026-03-27T12:33:57Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T19:25:27.67679Z"}],"ghsa":[{"id":"GHSA-3322-wpc2-p4m7","title":"If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP...","description":"If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out auth_username_chars, or install fixed version. No publicly available exploits are known.","status":"published","published":"2026-03-27T09:31:19Z","modified":"2026-03-27T09:31:29Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-90"],"updated_at":"2026-11-02T15:06:54.074781Z"}],"nvd":[{"id":"CVE-2026-27860","description":"If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out auth_username_chars, or install fixed version. No publicly available exploits are known.","status":"published","published":"2026-03-27T09:16:20.383Z","modified":"2026-10-26T00:10:00.15Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-90"],"updated_at":"2026-11-02T14:12:11.678711Z"}],"osv":[{"id":"ALPINE-CVE-2026-27860","description":"If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out auth_username_chars, or install fixed version. No publicly available exploits are known.","status":"published","published":"2026-03-27T09:16:20.383Z","modified":"2026-10-01T02:17:49.224935353Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"CVE-2026-27860","description":"If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out auth_username_chars, or install fixed version. No publicly available exploits are known.","status":"published","published":"2026-03-27T08:10:22.695Z","modified":"2026-10-28T02:30:55.557197634Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-90"],"updated_at":"2026-11-02T15:45:00.180685Z"},{"id":"DEBIAN-CVE-2026-27860","description":"If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out auth_username_chars, or install fixed version. No publicly available exploits are known.","status":"published","published":"2026-03-27T09:16:20.383Z","modified":"2026-10-26T11:47:29.928872349Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"UBUNTU-CVE-2026-27860","description":"If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out auth_username_chars, or install fixed version. No publicly available exploits are known.","status":"published","published":"2026-03-27T00:00:00Z","modified":"2026-05-04T10:46:10.142349Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"AZL-81716","title":"CVE-2026-27860 affecting package dovecot 2.3.20-1","description":"If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out auth_username_chars, or install fixed version. No publicly available exploits are known.","status":"published","published":"2026-03-27T09:16:20Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.988217Z"},{"id":"openSUSE-SU-2026:10442-1","title":"dovecot24-2.4.3-1.1 on GA media","description":"These are all security issues fixed in the dovecot24-2.4.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-27T00:00:00Z","modified":"2026-03-28T08:45:58.692143Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20554-1","title":"Security update for dovecot24","description":"This update for dovecot24 fixes the following issues:\n\n- Update to v2.4.3\n- CVE-2025-59028: Invalid base64 authentication can cause DoS for other logins (bsc#1260894).\n- CVE-2025-59031: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing\n  (bsc#1260895).\n- CVE-2025-59032: pigeonhole: ManageSieve panic occurs with sieve-connect as a client (bsc#1260902).\n- CVE-2026-24031: SQL injection possible if auth_username_chars is configured empty. Fixed escaping to always happen.\n  v2.4 regression (bsc#1260896).\n- CVE-2026-27855: OTP driver vulnerable to replay attack (bsc#1260900).\n- CVE-2026-27856: Doveadm credentials were not checked using timing-safe checking function (bsc#1260899).\n- CVE-2026-27857: sending excessive parenthesis causes imap-login to use excessive memory (bsc#1260898).\n- CVE-2026-27858: pigeonhole: managesieve-login can allocate large amount of memory during authentication (bsc#1260901).\n- CVE-2026-27859: excessive RFC 2231 MIME parameters in email would can excessive CPU usage (bsc#1260897).\n- CVE-2026-27860: LDAP query injection possible if auth_username_chars is configured empty. Fixed escaping to always\n  happen. v2.4 regression (bsc#1260893).\n","status":"published","published":"2026-04-16T13:10:27Z","modified":"2026-04-22T18:27:08.975719Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:21208-1","title":"Security update for dovecot24","description":"This update for dovecot24 fixes the following issues:\n\n- Update to v2.4.3\n- CVE-2025-59028: Invalid base64 authentication can cause DoS for other logins (bsc#1260894).\n- CVE-2025-59031: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing\n  (bsc#1260895).\n- CVE-2025-59032: pigeonhole: ManageSieve panic occurs with sieve-connect as a client (bsc#1260902).\n- CVE-2026-24031: SQL injection possible if auth_username_chars is configured empty. Fixed escaping to always happen.\n  v2.4 regression (bsc#1260896).\n- CVE-2026-27855: OTP driver vulnerable to replay attack (bsc#1260900).\n- CVE-2026-27856: Doveadm credentials were not checked using timing-safe checking function (bsc#1260899).\n- CVE-2026-27857: sending excessive parenthesis causes imap-login to use excessive memory (bsc#1260898).\n- CVE-2026-27858: pigeonhole: managesieve-login can allocate large amount of memory during authentication (bsc#1260901).\n- CVE-2026-27859: excessive RFC 2231 MIME parameters in email would can excessive CPU usage (bsc#1260897).\n- CVE-2026-27860: LDAP query injection possible if auth_username_chars is configured empty. Fixed escaping to always\n  happen. v2.4 regression (bsc#1260893).\n","status":"published","published":"2026-04-16T13:15:05Z","modified":"2026-04-22T18:26:16.302742Z","updated_at":"2026-11-02T15:54:02.312556Z"}]}}