{"id":"CVE-2026-33263","aliases":["ALPINE-CVE-2026-33263","ALSA-2026:76763","ALSA-2026:79371","ALSA-2026:80825","AZL-98313","CLSA-2026-1792570553","DEBIAN-CVE-2026-33263","EUVD-2026-67658","GHSA-9rqj-cvwq-v6qh","MGASA-2026-0385","RHSA-2026:76763","RHSA-2026:79371","RHSA-2026:80825","RLSA-2026:76763","RLSA-2026:79371","RLSA-2026:80825","SUSE-SU-2026:23595-1","SUSE-SU-2026:4139-1","UBUNTU-CVE-2026-33263","openSUSE-SU-2026:11629-1","openSUSE-SU-2026:21720-1"],"status":"published","title":"When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with...","description":"When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. If running in high-security mode (default for community releases), only the new submission connection gets terminated. If running in high-performance mode (default for Pro releases), all connections handled by the submission-login process will be terminated. The crashes can cause failure for user to send a message, or it can cause duplicate messages to be sent. If TLS is not used (in the backend server processing the submission), duplicate deliveries cannot happen, because the crash can only happen at AUTH stage. Limit the number of connections handled by single submission-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00554,"percentile":0.46507,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-403"],"published":"2026-08-28T00:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"dovecot","fixed_in":["2.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"dovecot","fixed_in":["2.4.5-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"dovecot","fixed_in":["1:2.3.19.1+dfsg1-2.1+deb12u7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dovecot","fixed_in":["1:2.4.1+dfsg1-6+deb13u7"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dovecot","fixed_in":["1:2.4.5+dfsg1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Azure Linux:3","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.20-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-8.el9_2.tuxcare.els8"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-8.el9_2.tuxcare.els8"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-8.el9_2.tuxcare.els8"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-8.el9_2.tuxcare.els8"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-8.el9_2.tuxcare.els8"}]}],"bundled":7},{"source":"osv","ecosystem":"Debian:12","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.19.1+dfsg1-2.1+deb12u7"}]}],"versions":["1:2.3.19.1+dfsg1-2.1","1:2.3.19.1+dfsg1-2.1+deb12u1","1:2.3.19.1+dfsg1-2.1+deb12u2","1:2.3.19.1+dfsg1-2.1+deb12u3","1:2.3.19.1+dfsg1-2.1+deb12u4","1:2.3.19.1+dfsg1-2.1+deb12u5","1:2.3.19.1+dfsg1-2.1+deb12u6"]},{"source":"osv","ecosystem":"Debian:13","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.1+dfsg1-6+deb13u7"}]}],"versions":["1:2.4.1+dfsg1-6","1:2.4.1+dfsg1-6+deb13u1","1:2.4.1+dfsg1-6+deb13u2","1:2.4.1+dfsg1-6+deb13u3","1:2.4.1+dfsg1-6+deb13u4","1:2.4.1+dfsg1-6+deb13u5","1:2.4.1+dfsg1-6+deb13u6"]},{"source":"osv","ecosystem":"Debian:14","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.5+dfsg1-1"}]}],"versions":["1:2.4.1+dfsg1-6","1:2.4.1+dfsg1-7","1:2.4.1+dfsg1-8","1:2.4.1+dfsg1-9","1:2.4.2+dfsg1-1","1:2.4.2+dfsg1-2","1:2.4.2+dfsg1-3","1:2.4.2+dfsg1-4","1:2.4.3+dfsg1-1","1:2.4.3+dfsg1-2","1:2.4.4+dfsg1-1","1:2.4.4+dfsg1-2"]},{"source":"osv","ecosystem":"Mageia:10","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-2.mga10"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pigeonhole-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-pigeonhole-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-pigeonhole-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-pigeonhole-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-pigeonhole-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:10","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-160000.2.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-160000.2.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.1.7-7ubuntu3","1:2.2.9-1ubuntu1","1:2.2.9-1ubuntu2","1:2.2.9-1ubuntu2.1","1:2.2.9-1ubuntu2.3","1:2.2.9-1ubuntu2.4","1:2.2.9-1ubuntu2.5","1:2.2.9-1ubuntu2.6","1:2.2.9-1ubuntu2.6+esm1","1:2.2.9-1ubuntu2.6+esm2","1:2.2.9-1ubuntu2.6+esm3","1:2.2.9-1ubuntu2.6+esm4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.2.18-2ubuntu2","1:2.2.22-1ubuntu1","1:2.2.22-1ubuntu2","1:2.2.22-1ubuntu2.1","1:2.2.22-1ubuntu2.2","1:2.2.22-1ubuntu2.3","1:2.2.22-1ubuntu2.4","1:2.2.22-1ubuntu2.6","1:2.2.22-1ubuntu2.7","1:2.2.22-1ubuntu2.8","1:2.2.22-1ubuntu2.9","1:2.2.22-1ubuntu2.10","1:2.2.22-1ubuntu2.11","1:2.2.22-1ubuntu2.12","1:2.2.22-1ubuntu2.13","1:2.2.22-1ubuntu2.14"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.2.27-3ubuntu1","1:2.2.33.2-1ubuntu1","1:2.2.33.2-1ubuntu2","1:2.2.33.2-1ubuntu3","1:2.2.33.2-1ubuntu4","1:2.2.33.2-1ubuntu4.1","1:2.2.33.2-1ubuntu4.2","1:2.2.33.2-1ubuntu4.3","1:2.2.33.2-1ubuntu4.4","1:2.2.33.2-1ubuntu4.5","1:2.2.33.2-1ubuntu4.6","1:2.2.33.2-1ubuntu4.7","1:2.2.33.2-1ubuntu4.8"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3.4.1-5ubuntu3","1:2.3.7.2-1ubuntu1","1:2.3.7.2-1ubuntu2","1:2.3.7.2-1ubuntu3","1:2.3.7.2-1ubuntu3.1","1:2.3.7.2-1ubuntu3.2","1:2.3.7.2-1ubuntu3.3","1:2.3.7.2-1ubuntu3.4","1:2.3.7.2-1ubuntu3.5","1:2.3.7.2-1ubuntu3.6","1:2.3.7.2-1ubuntu3.7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3.13+dfsg1-1ubuntu3","1:2.3.16+dfsg1-3ubuntu1","1:2.3.16+dfsg1-3ubuntu2","1:2.3.16+dfsg1-3ubuntu2.1","1:2.3.16+dfsg1-3ubuntu2.2","1:2.3.16+dfsg1-3ubuntu2.4","1:2.3.16+dfsg1-3ubuntu2.6","1:2.3.16+dfsg1-3ubuntu2.7","1:2.3.16+dfsg1-3ubuntu2.8","1:2.3.16+dfsg1-3ubuntu2.9"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3.20+dfsg1-1ubuntu3","1:2.3.21+dfsg1-2ubuntu1","1:2.3.21+dfsg1-2ubuntu2","1:2.3.21+dfsg1-2ubuntu4","1:2.3.21+dfsg1-2ubuntu5","1:2.3.21+dfsg1-2ubuntu6","1:2.3.21+dfsg1-2ubuntu6.1","1:2.3.21+dfsg1-2ubuntu6.2","1:2.3.21+dfsg1-2ubuntu6.3","1:2.3.21+dfsg1-2ubuntu6.4","1:2.3.21+dfsg1-2ubuntu6.5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.4.1+dfsg1-5ubuntu4","1:2.4.1+dfsg1-5ubuntu5","1:2.4.2+dfsg1-3ubuntu1","1:2.4.2+dfsg1-3ubuntu2","1:2.4.2+dfsg1-3ubuntu2.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-1.1"}]}],"bundled":22},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-160000.2.1"}]}],"bundled":24}],"products":[{"vendor":"open-xchange gmbh","product":"ox dovecot ce"},{"vendor":"open-xchange gmbh","product":"ox dovecot pro"}],"references":[{"url":"https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json","tags":["vendor-advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33263","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-9rqj-cvwq-v6qh"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-33263","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76763","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27852","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33263","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33605","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40018","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40019","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42007","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42391","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73208","tags":["report"]},{"url":"https://bugzilla.redhat.com/2525545","tags":["report"]},{"url":"https://bugzilla.redhat.com/2525547","tags":["report"]},{"url":"https://bugzilla.redhat.com/2525557","tags":["report"]},{"url":"https://bugzilla.redhat.com/2525559","tags":["report"]},{"url":"https://bugzilla.redhat.com/2525567","tags":["report"]},{"url":"https://bugzilla.redhat.com/2525576","tags":["report"]},{"url":"https://bugzilla.redhat.com/2525583","tags":["report"]},{"url":"https://bugzilla.redhat.com/2525584","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-76763.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:79371","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-79371.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:80825","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-80825.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792570553.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27852","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33605","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40018","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42007","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42391","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73208","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-33263","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0385.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36219","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/28/1","tags":["web"]},{"url":"https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525545","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525547","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525557","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525559","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525567","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525576","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525583","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525584","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-176273","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76763.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27852","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33263","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33605","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40018","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40019","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40019","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42007","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42391","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73208","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_79371.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80825.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:76763","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:79371","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:80825","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623595-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276794","tags":["report"]},{"url":"https://bugzilla.suse.com/1276795","tags":["report"]},{"url":"https://bugzilla.suse.com/1276799","tags":["report"]},{"url":"https://bugzilla.suse.com/1276800","tags":["report"]},{"url":"https://bugzilla.suse.com/1276802","tags":["report"]},{"url":"https://bugzilla.suse.com/1276804","tags":["report"]},{"url":"https://bugzilla.suse.com/1276807","tags":["report"]},{"url":"https://bugzilla.suse.com/1276809","tags":["report"]},{"url":"https://bugzilla.suse.com/1276810","tags":["report"]},{"url":"https://bugzilla.suse.com/1276812","tags":["report"]},{"url":"https://bugzilla.suse.com/1276813","tags":["report"]},{"url":"https://bugzilla.suse.com/1276815","tags":["report"]},{"url":"https://bugzilla.suse.com/1276817","tags":["report"]},{"url":"https://bugzilla.suse.com/1276819","tags":["report"]},{"url":"https://bugzilla.suse.com/1276820","tags":["report"]},{"url":"https://bugzilla.suse.com/1276824","tags":["report"]},{"url":"https://bugzilla.suse.com/1276826","tags":["report"]},{"url":"https://bugzilla.suse.com/1276827","tags":["report"]},{"url":"https://bugzilla.suse.com/1276828","tags":["report"]},{"url":"https://bugzilla.suse.com/1276829","tags":["report"]},{"url":"https://bugzilla.suse.com/1276830","tags":["report"]},{"url":"https://bugzilla.suse.com/1276833","tags":["report"]},{"url":"https://bugzilla.suse.com/1276835","tags":["report"]},{"url":"https://bugzilla.suse.com/1276837","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73209","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264139-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1229183","tags":["report"]},{"url":"https://bugzilla.suse.com/1229184","tags":["report"]},{"url":"https://bugzilla.suse.com/1260894","tags":["report"]},{"url":"https://bugzilla.suse.com/1260895","tags":["report"]},{"url":"https://bugzilla.suse.com/1260897","tags":["report"]},{"url":"https://bugzilla.suse.com/1260898","tags":["report"]},{"url":"https://bugzilla.suse.com/1260899","tags":["report"]},{"url":"https://bugzilla.suse.com/1260900","tags":["report"]},{"url":"https://bugzilla.suse.com/1260901","tags":["report"]},{"url":"https://bugzilla.suse.com/1260902","tags":["report"]},{"url":"https://bugzilla.suse.com/1265147","tags":["report"]},{"url":"https://bugzilla.suse.com/1265148","tags":["report"]},{"url":"https://bugzilla.suse.com/1265149","tags":["report"]},{"url":"https://bugzilla.suse.com/1265150","tags":["report"]},{"url":"https://bugzilla.suse.com/1276811","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42006","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-33263","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4200","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-33263","description":"When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. If running in high-security mode (default for community releases), only the new submission connection gets terminated. If running in high-performance mode (default for Pro releases), all connections handled by the submission-login process will be terminated. The crashes can cause failure for user to send a message, or it can cause duplicate messages to be sent. If TLS is not used (in the backend server processing the submission), duplicate deliveries cannot happen, because the crash can only happen at AUTH stage. Limit the number of connections handled by single submission-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T10:12:12.032Z","modified":"2026-08-28T15:55:33.617Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-403"],"updated_at":"2026-11-02T14:20:08.009733Z"}],"euvd":[{"id":"EUVD-2026-67658","description":"When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. If running in high-security mode (default for community releases), only the new submission connection gets terminated. If running in high-performance mode (default for Pro releases), all connections handled by the submission-login process will be terminated. The crashes can cause failure for user to send a message, or it can cause duplicate messages to be sent. If TLS is not used (in the backend server processing the submission), duplicate deliveries cannot happen, because the crash can only happen at AUTH stage. Limit the number of connections handled by single submission-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T10:12:12Z","modified":"2026-08-28T15:55:33Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T18:01:23.104802Z"}],"ghsa":[{"id":"GHSA-9rqj-cvwq-v6qh","title":"When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with...","description":"When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. If running in high-security mode (default for community releases), only the new submission connection gets terminated. If running in high-performance mode (default for Pro releases), all connections handled by the submission-login process will be terminated. The crashes can cause failure for user to send a message, or it can cause duplicate messages to be sent. If TLS is not used (in the backend server processing the submission), duplicate deliveries cannot happen, because the crash can only happen at AUTH stage. Limit the number of connections handled by single submission-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T12:30:25Z","modified":"2026-08-28T12:30:35Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-403"],"updated_at":"2026-11-02T15:11:06.970333Z"}],"nvd":[{"id":"CVE-2026-33263","description":"When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. If running in high-security mode (default for community releases), only the new submission connection gets terminated. If running in high-performance mode (default for Pro releases), all connections handled by the submission-login process will be terminated. The crashes can cause failure for user to send a message, or it can cause duplicate messages to be sent. If TLS is not used (in the backend server processing the submission), duplicate deliveries cannot happen, because the crash can only happen at AUTH stage. Limit the number of connections handled by single submission-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T12:16:27.483Z","modified":"2026-09-03T18:13:44.643Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-403"],"updated_at":"2026-11-02T14:12:42.366888Z"}],"osv":[{"id":"ALPINE-CVE-2026-33263","description":"When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. If running in high-security mode (default for community releases), only the new submission connection gets terminated. If running in high-performance mode (default for Pro releases), all connections handled by the submission-login process will be terminated. The crashes can cause failure for user to send a message, or it can cause duplicate messages to be sent. If TLS is not used (in the backend server processing the submission), duplicate deliveries cannot happen, because the crash can only happen at AUTH stage. Limit the number of connections handled by single submission-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T12:16:27.483Z","modified":"2026-10-01T02:17:49.245754419Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"DEBIAN-CVE-2026-33263","description":"When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. If running in high-security mode (default for community releases), only the new submission connection gets terminated. If running in high-performance mode (default for Pro releases), all connections handled by the submission-login process will be terminated. The crashes can cause failure for user to send a message, or it can cause duplicate messages to be sent. If TLS is not used (in the backend server processing the submission), duplicate deliveries cannot happen, because the crash can only happen at AUTH stage. Limit the number of connections handled by single submission-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T12:16:27.483Z","modified":"2026-10-31T16:04:23.094349159Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"RHSA-2026:76763","title":"Red Hat Security Advisory: dovecot security, bug fix, and enhancement update","status":"published","published":"2026-10-07T10:20:12Z","modified":"2026-10-14T10:30:50Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:79371","title":"Red Hat Security Advisory: dovecot security update","status":"published","published":"2026-10-10T10:22:51Z","modified":"2026-10-14T10:31:32Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:80825","title":"Red Hat Security Advisory: dovecot security update","status":"published","published":"2026-10-14T10:32:18Z","modified":"2026-10-14T10:48:13.36336687Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:76763","title":"Important: dovecot security, bug fix, and enhancement update","description":"Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. \n\nSecurity Fix(es):\n\n* dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)\n\n* dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)\n\n* dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)\n\n* dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)\n\n* dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)\n\n* dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)\n\n* dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)\n\n* dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)\n\nBug Fix(es) and Enhancement(s):\n\n* Dovecot crashes when accessing mailbox with: \"Panic: file mail-user.c: line 229 (mail_user_deinit): assertion failed: ((*user)-\u003erefcount == 1)\" (JIRA:Rocky Linux-176273)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-07T06:01:37.070463Z","modified":"2026-10-07T06:30:02.504205974Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:79371","title":"Important: dovecot security update","description":"Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. \n\nSecurity Fix(es):\n\n* dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)\n\n* dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)\n\n* dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)\n\n* dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)\n\n* dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)\n\n* dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)\n\n* dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)\n\n* dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-10T12:08:29.652489Z","modified":"2026-10-10T12:30:02.802466374Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:80825","title":"Important: dovecot security update","description":"Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. \n\nSecurity Fix(es):\n\n* dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)\n\n* dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)\n\n* dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)\n\n* dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)\n\n* dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)\n\n* dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)\n\n* dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)\n\n* dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-14T06:30:05.473043Z","modified":"2026-10-14T07:00:03.752889242Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-33263","description":"When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. If running in high-security mode (default for community releases), only the new submission connection gets terminated. If running in high-performance mode (default for Pro releases), all connections handled by the submission-login process will be terminated. The crashes can cause failure for user to send a message, or it can cause duplicate messages to be sent. If TLS is not used (in the backend server processing the submission), duplicate deliveries cannot happen, because the crash can only happen at AUTH stage. Limit the number of connections handled by single submission-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T00:00:00Z","modified":"2026-09-02T19:35:44.568639278Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"ALSA-2026:76763","title":"Important: dovecot security, bug fix, and enhancement update","description":"Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.   \n\nSecurity Fix(es):  \n\n  * dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)\n  * dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)\n  * dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)\n  * dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)\n  * dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)\n  * dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)\n  * dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)\n  * dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Dovecot crashes when accessing mailbox with: \"Panic: file mail-user.c: line 229 (mail_user_deinit): assertion failed: ((*user)-\u003erefcount == 1)\" (JIRA:AlmaLinux-176273)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-06T00:00:00Z","modified":"2026-10-29T11:02:29.698212973Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:79371","title":"Important: dovecot security update","description":"Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.   \n\nSecurity Fix(es):  \n\n  * dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)\n  * dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)\n  * dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)\n  * dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)\n  * dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)\n  * dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)\n  * dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)\n  * dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-08T00:00:00Z","modified":"2026-10-29T11:30:22.696711302Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:80825","title":"Important: dovecot security update","description":"Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.   \n\nSecurity Fix(es):  \n\n  * dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)\n  * dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)\n  * dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)\n  * dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)\n  * dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)\n  * dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)\n  * dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)\n  * dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-12T00:00:00Z","modified":"2026-10-29T11:32:38.156304729Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-98313","title":"CVE-2026-33263 affecting package dovecot 2.3.20-1","description":"When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. If running in high-security mode (default for community releases), only the new submission connection gets terminated. If running in high-performance mode (default for Pro releases), all connections handled by the submission-login process will be terminated. The crashes can cause failure for user to send a message, or it can cause duplicate messages to be sent. If TLS is not used (in the backend server processing the submission), duplicate deliveries cannot happen, because the crash can only happen at AUTH stage. Limit the number of connections handled by single submission-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T12:16:27Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"CLSA-2026-1792570553","title":"dovecot: Fix of 7 CVEs","description":"- CVE-2026-27852: bound the transient RFC 2231 parameter list and the MIME\n  parameter budget so a single oversized Content-Type header cannot exhaust\n  imap memory\n- CVE-2026-33263: track SMTP server connection closure so submission-login\n  does not keep using a closed connection\n- CVE-2026-33605: fix ManageSieve parser handling of a single-byte quoted\n  string read in managesieve-login\n- CVE-2026-40018: connect before expanding the passdb-sql password query and\n  refuse to escape in the MySQL driver without a connection instead of\n  escaping with the default charset\n- CVE-2026-42007: fix Sieve editheader edit-mail handling of deleted and\n  NUL-containing header values\n- CVE-2026-42391: account external key/value pairs in the IMAP login ID\n  command so a client cannot send an unbounded number of them\n- CVE-2026-73208: validate the OAuth2 token audience and stop falling back to\n  the aud claim when audience is configured","status":"published","published":"2026-10-21T08:16:09Z","modified":"2026-10-26T09:31:00.261538056Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"MGASA-2026-0385","title":"Updated dovecot package fixes security vulnerabilities","description":"submission-login: Panic when mail_max_userip_connections is reached:\nPanic: epoll_ctl(del, 8) failed: Bad file descriptor. (CVE-2026-33263)\nDovecot IMAP LIST match_sub() Exponential Backtracking — CPU Denial of\nService. (CVE-2026-33607)\nDoS by sending mail with bad header. (CVE-2026-27852)\ndsync: Mail content can cause dsync protocol injection. (CVE-2026-33606)\nSMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return.\n(CVE-2026-33604)\nIMAP THREAD REFERENCES O(N²) CPU DoS via Crafted References Header\n(index-thread-links.c). (CVE-2026-40014)\npigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve\nCHECKSCRIPT/PUTSCRIPT. (CVE-2026-40013)\nmanagesieve-login: Pre-auth crash. (CVE-2026-33605)\nMySQL multi-byte escaping wrong. (CVE-2026-40018)\nv2.4.3 regression: managesieve-login pre-auth infinite loop.\n(CVE-2026-40019)\nimap-hibernate can be crashed. (CVE-2026-40015)\nIMAP THREAD O(M³) CPU DoS via CRC32 Hash Collision in strmap\n(mail-index-strmap.c / hash2.c). (CVE-2026-40017)\nIMAP Compression Can Reveal Whether a Small Synced Email Body Matches\nSender-Chosen Text. (CVE-2026-40203)\nSieve editheader RCE. (CVE-2026-42007)\nacl: lda_mailbox_autocreate can bypass acl restrictions.\n(CVE-2026-40204)\nOAuth2 passdb scope enforcement bypass via OR semantics in remote\nvalidation path. (CVE-2026-40205)\nXCLIENT FORWARD= bare token not namespaced, allows nopassword injection\nvia trusted proxy. (CVE-2026-42008)\nSingle NUL-Byte XCLIENT FORWARD Payload Crashes. (CVE-2026-42395)\ndoveadm_password or api key length can still be leaked with timing\ncomparisons. (CVE-2026-42393)\nSieve resource usage tracking lost when active script changes.\n(CVE-2026-52681)\nimap-urlauth leaks memory into user-visible error messages.\n(CVE-2026-42392)\nauth: db-oauth2: aud claim used as fallback for missing scope claim.\n(CVE-2026-73208)\nimap-login crash: Self-recursion on zero-output decompress chunks.\n(CVE-2026-73209)\nimap: Pre-login memory/CPU growth with ID command. (CVE-2026-42391)\nIMAP: COMPRESS ZSTD can cause excessive memory usage. (CVE-2026-52687)\n","status":"published","published":"2026-09-09T04:15:20Z","modified":"2026-09-09T04:42:22.817277874Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11629-1","title":"dovecot24-2.4.5-1.1 on GA media","description":"These are all security issues fixed in the dovecot24-2.4.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-28T00:00:00Z","modified":"2026-08-29T09:15:04.342434035Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21720-1","title":"Security update for dovecot24","description":"This update for dovecot24 fixes the following issues:\n\nUpdate to 2.4.5.\n\n- CVE-2026-33263: `submission-login`: panic when `mail_max_userip_connections` is reached (bsc#1276794).\n- CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799).\n- CVE-2026-33604: SMTP smuggling via missing dot-stuffing after bare carriage return (bsc#1276802).\n- CVE-2026-33605: `managesieve-login`: pre-auth crash (bsc#1276809).\n- CVE-2026-33606: `dsync`: mail content can cause `dsync` protocol injection (bsc#1276800).\n- CVE-2026-33607: IMAP `LIST` `match_sub()` exponential backtracking leading to CPU denial of service (bsc#1276795).\n- CVE-2026-40013: stack buffer underflow in `pigeonhole` `ManageSieve` `CHECKSCRIPT/PUTSCRIPT` (bsc#1276807).\n- CVE-2026-40014: CPU DoS via crafted references header (bsc#1276804).\n- CVE-2026-40015: `imap-hibernate` can be crashed (bsc#1276812).\n- CVE-2026-40017: CPU DoS via CRC32 hash collision in `strmap` (bsc#1276813).\n- CVE-2026-40018: MySQL multi-byte escaping performed incorrectly (bsc#1276810).\n- CVE-2026-40203: IMAP compression can reveal whether a small synced email body matches sender-chosen text\n  (bsc#1276815).\n- CVE-2026-40204: `lda_mailbox_autocreate` can bypass ACL restrictions (bsc#1276819).\n- CVE-2026-40205: OAuth2 `passdb` scope enforcement bypass via OR semantics in remote validation path (bsc#1276820).\n- CVE-2026-42007: `sieve` `editheader` RCE (bsc#1276817).\n- CVE-2026-42008: `XCLIENT FORWARD= bare` token not namespaced (bsc#1276824).\n- CVE-2026-42391: `imap`: pre-login memory/CPU growth with `ID` command (bsc#1276835).\n- CVE-2026-42392: `imap-urlauth` leaks memory into user-visible error messages (bsc#1276829).\n- CVE-2026-42393: `doveadm_password` or api key length can be leaked with timing comparisons (bsc#1276827).\n- CVE-2026-52687: `imap`: `COMPRESS ZSTD` can cause excessive memory usage (bsc#1276837).\n- CVE-2026-42395: single NUL-byte `XCLIENT FORWARD` payload crashes (bsc#1276826).\n- CVE-2026-52681: `sieve` resource usage tracking lost when active script changes (bsc#1276828).\n- CVE-2026-73208: `auth`: `db-oauth2`: `aud` claim used as fallback for missing scope claim (bsc#1276830).\n- CVE-2026-73209: `imap-login` crash due to self-recursion on zero-output decompress chunks (bsc#1276833).\n","status":"published","published":"2026-09-01T14:18:02Z","modified":"2026-09-02T18:00:03.64873556Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23595-1","title":"Security update for dovecot24","description":"This update for dovecot24 fixes the following issues:\n\nUpdate to 2.4.5.\n\n- CVE-2026-33263: `submission-login`: panic when `mail_max_userip_connections` is reached (bsc#1276794).\n- CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799).\n- CVE-2026-33604: SMTP smuggling via missing dot-stuffing after bare carriage return (bsc#1276802).\n- CVE-2026-33605: `managesieve-login`: pre-auth crash (bsc#1276809).\n- CVE-2026-33606: `dsync`: mail content can cause `dsync` protocol injection (bsc#1276800).\n- CVE-2026-33607: IMAP `LIST` `match_sub()` exponential backtracking leading to CPU denial of service (bsc#1276795).\n- CVE-2026-40013: stack buffer underflow in `pigeonhole` `ManageSieve` `CHECKSCRIPT/PUTSCRIPT` (bsc#1276807).\n- CVE-2026-40014: CPU DoS via crafted references header (bsc#1276804).\n- CVE-2026-40015: `imap-hibernate` can be crashed (bsc#1276812).\n- CVE-2026-40017: CPU DoS via CRC32 hash collision in `strmap` (bsc#1276813).\n- CVE-2026-40018: MySQL multi-byte escaping performed incorrectly (bsc#1276810).\n- CVE-2026-40203: IMAP compression can reveal whether a small synced email body matches sender-chosen text\n  (bsc#1276815).\n- CVE-2026-40204: `lda_mailbox_autocreate` can bypass ACL restrictions (bsc#1276819).\n- CVE-2026-40205: OAuth2 `passdb` scope enforcement bypass via OR semantics in remote validation path (bsc#1276820).\n- CVE-2026-42007: `sieve` `editheader` RCE (bsc#1276817).\n- CVE-2026-42008: `XCLIENT FORWARD= bare` token not namespaced (bsc#1276824).\n- CVE-2026-42391: `imap`: pre-login memory/CPU growth with `ID` command (bsc#1276835).\n- CVE-2026-42392: `imap-urlauth` leaks memory into user-visible error messages (bsc#1276829).\n- CVE-2026-42393: `doveadm_password` or api key length can be leaked with timing comparisons (bsc#1276827).\n- CVE-2026-52687: `imap`: `COMPRESS ZSTD` can cause excessive memory usage (bsc#1276837).\n- CVE-2026-42395: single NUL-byte `XCLIENT FORWARD` payload crashes (bsc#1276826).\n- CVE-2026-52681: `sieve` resource usage tracking lost when active script changes (bsc#1276828).\n- CVE-2026-73208: `auth`: `db-oauth2`: `aud` claim used as fallback for missing scope claim (bsc#1276830).\n- CVE-2026-73209: `imap-login` crash due to self-recursion on zero-output decompress chunks (bsc#1276833).\n","status":"published","published":"2026-09-01T14:12:16Z","modified":"2026-09-29T18:23:18.714105294Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:4139-1","title":"Security update for dovecot23","description":"This update for dovecot23 fixes the following issues:\n\n- CVE-2024-23184: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU\n  intensive (bsc#1229184).\n- CVE-2024-23185: large headers can cause resource exhaustion when parsing message (bsc#1229183).\n- CVE-2025-59028: Invalid base64 authentication can cause DoS for other logins (bsc#1260894).\n- CVE-2025-59031: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing\n  (bsc#1260895).\n- CVE-2025-59032: pigeonhole: ManageSieve panic occurs with sieve-connect as a client (bsc#1260902).\n- CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799).\n- CVE-2026-27855: OTP driver vulnerable to replay attack (bsc#1260900).\n- CVE-2026-27856: Doveadm credentials were not checked using timing-safe checking function (bsc#1260899).\n- CVE-2026-27857: sending excessive parenthesis causes imap-login to use excessive memory (bsc#1260898).\n- CVE-2026-27858: pigeonhole: managesieve-login can allocate large amount of memory during authentication (bsc#1260901).\n- CVE-2026-27859: excessive RFC 2231 MIME parameters in email would can excessive CPU usage (bsc#1260897).\n- CVE-2026-33263: submission-login: Panic when mail_max_userip_connections is reached (bsc#1276794).\n- CVE-2026-33603: login: base64 input can contain tabs that bypass IPC protection (bsc#1265147).\n- CVE-2026-33604: SMTP Smuggling via Missing Dot-Stuffing (bsc#1276802).\n- CVE-2026-33605: managesieve-login: Pre-auth crash (bsc#1276809).\n- CVE-2026-33606: dsync: Mail content can cause dsync protocol injection (bsc#1276800).\n- CVE-2026-33607: IMAP LIST match_sub() Exponential Backtracking -- CPU Denial of Service (bsc#1276795).\n- CVE-2026-40014: CPU DoS via Crafted References Header (bsc#1276804).\n- CVE-2026-40015: imap-hibernate can be crashed (bsc#1276812).\n- CVE-2026-40016: Sieve :contains/:matches O(NxM) substring match bypasses sieve_max_cpu_time limit (bsc#1265148).\n- CVE-2026-40019: managesieve-login pre-auth infinite loop (bsc#1276811).\n- CVE-2026-40020: IMAP folders can be shared-spammed to everyone (bsc#1265149).\n- CVE-2026-40203: IMAP Compression Can Reveal Whether a Small Synced Email Body Matches Sender-Chosen Text\n  (bsc#1276815).\n- CVE-2026-40205: OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path (bsc#1276820).\n- CVE-2026-42006: imap-login: uncontrolled memory usage with excessive bracing over IMAP (bsc#1265150).\n- CVE-2026-42007: editheader RCE (bsc#1276817).\n- CVE-2026-42008: XCLIENT FORWARD= bare token not namespaced (bsc#1276824).\n- CVE-2026-42391: imap: Pre-login memory/CPU growth with ID command (bsc#1276835).\n- CVE-2026-42393: doveadm_password or api key length can still be leaked with timing comparisons (bsc#1276827).\n- CVE-2026-42395: Single NUL-Byte XCLIENT FORWARD Payload Crashes (bsc#1276826).\n- CVE-2026-52681: Sieve resource usage tracking lost when active script changes (bsc#1276828).\n- CVE-2026-52687: IMAP: COMPRESS ZSTD can cause excessive memory usage (bsc#1276837).\n- CVE-2026-73208: auth: db-oauth2: aud claim used as fallback for missing scope claim (bsc#1276830).\n- CVE-2026-73209: imap-login crash: Self-recursion on zero-output decompress chunks (bsc#1276833).\n\nChanges for dovecot23:\n\n- Update to version 2.3.21.1.\n","status":"published","published":"2026-09-14T07:22:32Z","modified":"2026-09-28T18:23:12.561527353Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}