{"id":"CVE-2026-42007","aliases":["ALPINE-CVE-2026-42007","ALSA-2026:76763","ALSA-2026:79371","ALSA-2026:80825","AZL-98298","CLSA-2026-1792570553","CLSA-2026-1792596933","CLSA-2026-1792753135","CLSA-2026-1792753365","CLSA-2026-1792764227","CLSA-2026-1792764393","DEBIAN-CVE-2026-42007","EUVD-2026-67672","GHSA-9h72-j5f4-5cpc","MGASA-2026-0385","RHSA-2026:76763","RHSA-2026:79371","RHSA-2026:80825","RLSA-2026:76763","RLSA-2026:79371","RLSA-2026:80825","SUSE-SU-2026:23595-1","SUSE-SU-2026:3919-1","SUSE-SU-2026:4139-1","UBUNTU-CVE-2026-42007","openSUSE-SU-2026:11629-1","openSUSE-SU-2026:21720-1"],"status":"published","title":"An attacker that has valid credentials can use a Sieve script with the editheader extension to...","description":"An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during mail delivery, which can crash the delivery process and may allow execution of arbitrary code in the context of that process. Disable the Sieve editheader extension. Update to non-vulnerable version. No publicly available exploits are known.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00345,"percentile":0.28249,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2026-08-28T00:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"dovecot","fixed_in":["2.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"dovecot","fixed_in":["2.4.5-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"dovecot","fixed_in":["1:2.3.16-15.el9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"dovecot-devel","fixed_in":["1:2.3.16-15.el9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"dovecot-mysql","fixed_in":["1:2.3.16-15.el9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"dovecot-pgsql","fixed_in":["1:2.3.16-15.el9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"dovecot-pigeonhole","fixed_in":["1:2.3.16-15.el9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"dovecot","fixed_in":["1:2.2.36-8.0.3.el7.tuxcare.els2","1:2.2.36-8.0.3.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"dovecot-devel","fixed_in":["1:2.2.36-8.0.3.el7.tuxcare.els2","1:2.2.36-8.0.3.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"dovecot-mysql","fixed_in":["1:2.2.36-8.0.3.el7.tuxcare.els2","1:2.2.36-8.0.3.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"dovecot-pgsql","fixed_in":["1:2.2.36-8.0.3.el7.tuxcare.els2","1:2.2.36-8.0.3.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"dovecot-pigeonhole","fixed_in":["1:2.2.36-8.0.3.el7.tuxcare.els2","1:2.2.36-8.0.3.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"dovecot","fixed_in":["1:2.2.36-8.0.3.el7.tuxcare.els2","1:2.2.36-8.0.3.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"dovecot-devel","fixed_in":["1:2.2.36-8.0.3.el7.tuxcare.els2","1:2.2.36-8.0.3.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"dovecot-mysql","fixed_in":["1:2.2.36-8.0.3.el7.tuxcare.els2","1:2.2.36-8.0.3.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"dovecot-pgsql","fixed_in":["1:2.2.36-8.0.3.el7.tuxcare.els2","1:2.2.36-8.0.3.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"dovecot-pigeonhole","fixed_in":["1:2.2.36-8.0.3.el7.tuxcare.els2","1:2.2.36-8.0.3.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"dovecot","fixed_in":["1:2.3.19.1+dfsg1-2.1+deb12u7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dovecot","fixed_in":["1:2.4.1+dfsg1-6+deb13u7"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dovecot","fixed_in":["1:2.4.5+dfsg1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Azure Linux:3","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.20-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-8.el9_2.tuxcare.els8"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-8.el9_2.tuxcare.els8"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-8.el9_2.tuxcare.els8"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-8.el9_2.tuxcare.els8"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-8.el9_2.tuxcare.els8"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-15.el9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-15.el9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-15.el9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-15.el9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-15.el9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-8.0.3.el7.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-8.0.3.el7.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-8.0.3.el7.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-8.0.3.el7.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-8.0.3.el7.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-8.0.3.el7.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-8.0.3.el7.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-8.0.3.el7.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-8.0.3.el7.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-8.0.3.el7.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-8.0.3.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-8.0.3.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-8.0.3.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-8.0.3.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-8.0.3.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-8.0.3.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-8.0.3.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-8.0.3.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-8.0.3.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-8.0.3.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.19.1+dfsg1-2.1+deb12u7"}]}],"versions":["1:2.3.19.1+dfsg1-2.1","1:2.3.19.1+dfsg1-2.1+deb12u1","1:2.3.19.1+dfsg1-2.1+deb12u2","1:2.3.19.1+dfsg1-2.1+deb12u3","1:2.3.19.1+dfsg1-2.1+deb12u4","1:2.3.19.1+dfsg1-2.1+deb12u5","1:2.3.19.1+dfsg1-2.1+deb12u6"]},{"source":"osv","ecosystem":"Debian:13","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.1+dfsg1-6+deb13u7"}]}],"versions":["1:2.4.1+dfsg1-6","1:2.4.1+dfsg1-6+deb13u1","1:2.4.1+dfsg1-6+deb13u2","1:2.4.1+dfsg1-6+deb13u3","1:2.4.1+dfsg1-6+deb13u4","1:2.4.1+dfsg1-6+deb13u5","1:2.4.1+dfsg1-6+deb13u6"]},{"source":"osv","ecosystem":"Debian:14","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.5+dfsg1-1"}]}],"versions":["1:2.4.1+dfsg1-6","1:2.4.1+dfsg1-7","1:2.4.1+dfsg1-8","1:2.4.1+dfsg1-9","1:2.4.2+dfsg1-1","1:2.4.2+dfsg1-2","1:2.4.2+dfsg1-3","1:2.4.2+dfsg1-4","1:2.4.3+dfsg1-1","1:2.4.3+dfsg1-2","1:2.4.4+dfsg1-1","1:2.4.4+dfsg1-2"]},{"source":"osv","ecosystem":"Mageia:10","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-2.mga10"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pigeonhole-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-pigeonhole-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-pigeonhole-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-pigeonhole-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-pigeonhole-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:10","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-160000.2.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-160000.2.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.40.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.40.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.1.7-7ubuntu3","1:2.2.9-1ubuntu1","1:2.2.9-1ubuntu2","1:2.2.9-1ubuntu2.1","1:2.2.9-1ubuntu2.3","1:2.2.9-1ubuntu2.4","1:2.2.9-1ubuntu2.5","1:2.2.9-1ubuntu2.6","1:2.2.9-1ubuntu2.6+esm1","1:2.2.9-1ubuntu2.6+esm2","1:2.2.9-1ubuntu2.6+esm3","1:2.2.9-1ubuntu2.6+esm4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.2.18-2ubuntu2","1:2.2.22-1ubuntu1","1:2.2.22-1ubuntu2","1:2.2.22-1ubuntu2.1","1:2.2.22-1ubuntu2.2","1:2.2.22-1ubuntu2.3","1:2.2.22-1ubuntu2.4","1:2.2.22-1ubuntu2.6","1:2.2.22-1ubuntu2.7","1:2.2.22-1ubuntu2.8","1:2.2.22-1ubuntu2.9","1:2.2.22-1ubuntu2.10","1:2.2.22-1ubuntu2.11","1:2.2.22-1ubuntu2.12","1:2.2.22-1ubuntu2.13","1:2.2.22-1ubuntu2.14"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.2.27-3ubuntu1","1:2.2.33.2-1ubuntu1","1:2.2.33.2-1ubuntu2","1:2.2.33.2-1ubuntu3","1:2.2.33.2-1ubuntu4","1:2.2.33.2-1ubuntu4.1","1:2.2.33.2-1ubuntu4.2","1:2.2.33.2-1ubuntu4.3","1:2.2.33.2-1ubuntu4.4","1:2.2.33.2-1ubuntu4.5","1:2.2.33.2-1ubuntu4.6","1:2.2.33.2-1ubuntu4.7","1:2.2.33.2-1ubuntu4.8"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3.4.1-5ubuntu3","1:2.3.7.2-1ubuntu1","1:2.3.7.2-1ubuntu2","1:2.3.7.2-1ubuntu3","1:2.3.7.2-1ubuntu3.1","1:2.3.7.2-1ubuntu3.2","1:2.3.7.2-1ubuntu3.3","1:2.3.7.2-1ubuntu3.4","1:2.3.7.2-1ubuntu3.5","1:2.3.7.2-1ubuntu3.6","1:2.3.7.2-1ubuntu3.7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3.13+dfsg1-1ubuntu3","1:2.3.16+dfsg1-3ubuntu1","1:2.3.16+dfsg1-3ubuntu2","1:2.3.16+dfsg1-3ubuntu2.1","1:2.3.16+dfsg1-3ubuntu2.2","1:2.3.16+dfsg1-3ubuntu2.4","1:2.3.16+dfsg1-3ubuntu2.6","1:2.3.16+dfsg1-3ubuntu2.7","1:2.3.16+dfsg1-3ubuntu2.8","1:2.3.16+dfsg1-3ubuntu2.9"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3.20+dfsg1-1ubuntu3","1:2.3.21+dfsg1-2ubuntu1","1:2.3.21+dfsg1-2ubuntu2","1:2.3.21+dfsg1-2ubuntu4","1:2.3.21+dfsg1-2ubuntu5","1:2.3.21+dfsg1-2ubuntu6","1:2.3.21+dfsg1-2ubuntu6.1","1:2.3.21+dfsg1-2ubuntu6.2","1:2.3.21+dfsg1-2ubuntu6.3","1:2.3.21+dfsg1-2ubuntu6.4","1:2.3.21+dfsg1-2ubuntu6.5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.4.1+dfsg1-5ubuntu4","1:2.4.1+dfsg1-5ubuntu5","1:2.4.2+dfsg1-3ubuntu1","1:2.4.2+dfsg1-3ubuntu2","1:2.4.2+dfsg1-3ubuntu2.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-1.1"}]}],"bundled":22},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-160000.2.1"}]}],"bundled":24}],"products":[{"vendor":"open-xchange gmbh","product":"ox dovecot ce"},{"vendor":"open-xchange gmbh","product":"ox dovecot pro"}],"references":[{"url":"https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json","tags":["vendor-advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42007","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-9h72-j5f4-5cpc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-42007","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76763","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27852","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33263","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33605","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40018","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40019","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42007","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42391","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73208","tags":["report"]},{"url":"https://bugzilla.redhat.com/2525545","tags":["report"]},{"url":"https://bugzilla.redhat.com/2525547","tags":["report"]},{"url":"https://bugzilla.redhat.com/2525557","tags":["report"]},{"url":"https://bugzilla.redhat.com/2525559","tags":["report"]},{"url":"https://bugzilla.redhat.com/2525567","tags":["report"]},{"url":"https://bugzilla.redhat.com/2525576","tags":["report"]},{"url":"https://bugzilla.redhat.com/2525583","tags":["report"]},{"url":"https://bugzilla.redhat.com/2525584","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-76763.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:79371","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-79371.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:80825","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-80825.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792570553.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27852","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33263","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33605","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40018","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42391","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73208","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792596933.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1792753135.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792753365.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1792764227.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792764393.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-42007","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0385.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36219","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/28/1","tags":["web"]},{"url":"https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525545","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525547","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525557","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525559","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525567","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525576","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525583","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525584","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-176273","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76763.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27852","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33263","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33605","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40018","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40019","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40019","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42007","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42391","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73208","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_79371.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80825.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:76763","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:79371","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:80825","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623595-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276794","tags":["report"]},{"url":"https://bugzilla.suse.com/1276795","tags":["report"]},{"url":"https://bugzilla.suse.com/1276799","tags":["report"]},{"url":"https://bugzilla.suse.com/1276800","tags":["report"]},{"url":"https://bugzilla.suse.com/1276802","tags":["report"]},{"url":"https://bugzilla.suse.com/1276804","tags":["report"]},{"url":"https://bugzilla.suse.com/1276807","tags":["report"]},{"url":"https://bugzilla.suse.com/1276809","tags":["report"]},{"url":"https://bugzilla.suse.com/1276810","tags":["report"]},{"url":"https://bugzilla.suse.com/1276812","tags":["report"]},{"url":"https://bugzilla.suse.com/1276813","tags":["report"]},{"url":"https://bugzilla.suse.com/1276815","tags":["report"]},{"url":"https://bugzilla.suse.com/1276817","tags":["report"]},{"url":"https://bugzilla.suse.com/1276819","tags":["report"]},{"url":"https://bugzilla.suse.com/1276820","tags":["report"]},{"url":"https://bugzilla.suse.com/1276824","tags":["report"]},{"url":"https://bugzilla.suse.com/1276826","tags":["report"]},{"url":"https://bugzilla.suse.com/1276827","tags":["report"]},{"url":"https://bugzilla.suse.com/1276828","tags":["report"]},{"url":"https://bugzilla.suse.com/1276829","tags":["report"]},{"url":"https://bugzilla.suse.com/1276830","tags":["report"]},{"url":"https://bugzilla.suse.com/1276833","tags":["report"]},{"url":"https://bugzilla.suse.com/1276835","tags":["report"]},{"url":"https://bugzilla.suse.com/1276837","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73209","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263919-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276792","tags":["report"]},{"url":"https://bugzilla.suse.com/1276811","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40019","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264139-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1229183","tags":["report"]},{"url":"https://bugzilla.suse.com/1229184","tags":["report"]},{"url":"https://bugzilla.suse.com/1260894","tags":["report"]},{"url":"https://bugzilla.suse.com/1260895","tags":["report"]},{"url":"https://bugzilla.suse.com/1260897","tags":["report"]},{"url":"https://bugzilla.suse.com/1260898","tags":["report"]},{"url":"https://bugzilla.suse.com/1260899","tags":["report"]},{"url":"https://bugzilla.suse.com/1260900","tags":["report"]},{"url":"https://bugzilla.suse.com/1260901","tags":["report"]},{"url":"https://bugzilla.suse.com/1260902","tags":["report"]},{"url":"https://bugzilla.suse.com/1265147","tags":["report"]},{"url":"https://bugzilla.suse.com/1265148","tags":["report"]},{"url":"https://bugzilla.suse.com/1265149","tags":["report"]},{"url":"https://bugzilla.suse.com/1265150","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42006","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-42007","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4200","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-42007","description":"An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during mail delivery, which can crash the delivery process and may allow execution of arbitrary code in the context of that process. Disable the Sieve editheader extension. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T10:12:25.136Z","modified":"2026-08-28T15:54:24.354Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T13:40:35.004553Z"}],"euvd":[{"id":"EUVD-2026-67672","description":"An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during mail delivery, which can crash the delivery process and may allow execution of arbitrary code in the context of that process. Disable the Sieve editheader extension. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T10:12:25Z","modified":"2026-08-28T15:54:24Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T18:01:23.104802Z"}],"ghsa":[{"id":"GHSA-9h72-j5f4-5cpc","title":"An attacker that has valid credentials can use a Sieve script with the editheader extension to...","description":"An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during mail delivery, which can crash the delivery process and may allow execution of arbitrary code in the context of that process. Disable the Sieve editheader extension. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T12:30:25Z","modified":"2026-08-28T12:30:35Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:11:06.970333Z"}],"nvd":[{"id":"CVE-2026-42007","description":"An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during mail delivery, which can crash the delivery process and may allow execution of arbitrary code in the context of that process. Disable the Sieve editheader extension. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T12:16:29.26Z","modified":"2026-09-03T18:13:44.643Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:12:42.366888Z"}],"osv":[{"id":"ALPINE-CVE-2026-42007","description":"An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during mail delivery, which can crash the delivery process and may allow execution of arbitrary code in the context of that process. Disable the Sieve editheader extension. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T12:16:29.26Z","modified":"2026-10-01T02:17:49.287384029Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"DEBIAN-CVE-2026-42007","description":"An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during mail delivery, which can crash the delivery process and may allow execution of arbitrary code in the context of that process. Disable the Sieve editheader extension. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T12:16:29.26Z","modified":"2026-10-31T16:04:23.652670803Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"RHSA-2026:76763","title":"Red Hat Security Advisory: dovecot security, bug fix, and enhancement update","status":"published","published":"2026-10-07T10:20:12Z","modified":"2026-10-14T10:30:50Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:79371","title":"Red Hat Security Advisory: dovecot security update","status":"published","published":"2026-10-10T10:22:51Z","modified":"2026-10-14T10:31:32Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:80825","title":"Red Hat Security Advisory: dovecot security update","status":"published","published":"2026-10-14T10:32:18Z","modified":"2026-10-14T10:48:13.36336687Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:76763","title":"Important: dovecot security, bug fix, and enhancement update","description":"Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. \n\nSecurity Fix(es):\n\n* dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)\n\n* dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)\n\n* dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)\n\n* dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)\n\n* dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)\n\n* dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)\n\n* dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)\n\n* dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)\n\nBug Fix(es) and Enhancement(s):\n\n* Dovecot crashes when accessing mailbox with: \"Panic: file mail-user.c: line 229 (mail_user_deinit): assertion failed: ((*user)-\u003erefcount == 1)\" (JIRA:Rocky Linux-176273)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-07T06:01:37.070463Z","modified":"2026-10-07T06:30:02.504205974Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:79371","title":"Important: dovecot security update","description":"Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. \n\nSecurity Fix(es):\n\n* dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)\n\n* dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)\n\n* dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)\n\n* dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)\n\n* dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)\n\n* dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)\n\n* dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)\n\n* dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-10T12:08:29.652489Z","modified":"2026-10-10T12:30:02.802466374Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:80825","title":"Important: dovecot security update","description":"Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. \n\nSecurity Fix(es):\n\n* dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)\n\n* dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)\n\n* dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)\n\n* dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)\n\n* dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)\n\n* dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)\n\n* dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)\n\n* dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-14T06:30:05.473043Z","modified":"2026-10-14T07:00:03.752889242Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-42007","description":"An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during mail delivery, which can crash the delivery process and may allow execution of arbitrary code in the context of that process. Disable the Sieve editheader extension. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T00:00:00Z","modified":"2026-09-02T19:35:44.822449947Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"ALSA-2026:76763","title":"Important: dovecot security, bug fix, and enhancement update","description":"Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.   \n\nSecurity Fix(es):  \n\n  * dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)\n  * dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)\n  * dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)\n  * dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)\n  * dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)\n  * dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)\n  * dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)\n  * dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Dovecot crashes when accessing mailbox with: \"Panic: file mail-user.c: line 229 (mail_user_deinit): assertion failed: ((*user)-\u003erefcount == 1)\" (JIRA:AlmaLinux-176273)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-06T00:00:00Z","modified":"2026-10-29T11:02:29.698212973Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:79371","title":"Important: dovecot security update","description":"Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.   \n\nSecurity Fix(es):  \n\n  * dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)\n  * dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)\n  * dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)\n  * dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)\n  * dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)\n  * dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)\n  * dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)\n  * dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-08T00:00:00Z","modified":"2026-10-29T11:30:22.696711302Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:80825","title":"Important: dovecot security update","description":"Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.   \n\nSecurity Fix(es):  \n\n  * dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)\n  * dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)\n  * dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)\n  * dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)\n  * dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)\n  * dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)\n  * dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)\n  * dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-12T00:00:00Z","modified":"2026-10-29T11:32:38.156304729Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-98298","title":"CVE-2026-42007 affecting package dovecot 2.3.20-1","description":"An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during mail delivery, which can crash the delivery process and may allow execution of arbitrary code in the context of that process. Disable the Sieve editheader extension. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T12:16:29Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"CLSA-2026-1792570553","title":"dovecot: Fix of 7 CVEs","description":"- CVE-2026-27852: bound the transient RFC 2231 parameter list and the MIME\n  parameter budget so a single oversized Content-Type header cannot exhaust\n  imap memory\n- CVE-2026-33263: track SMTP server connection closure so submission-login\n  does not keep using a closed connection\n- CVE-2026-33605: fix ManageSieve parser handling of a single-byte quoted\n  string read in managesieve-login\n- CVE-2026-40018: connect before expanding the passdb-sql password query and\n  refuse to escape in the MySQL driver without a connection instead of\n  escaping with the default charset\n- CVE-2026-42007: fix Sieve editheader edit-mail handling of deleted and\n  NUL-containing header values\n- CVE-2026-42391: account external key/value pairs in the IMAP login ID\n  command so a client cannot send an unbounded number of them\n- CVE-2026-73208: validate the OAuth2 token audience and stop falling back to\n  the aud claim when audience is configured","status":"published","published":"2026-10-21T08:16:09Z","modified":"2026-10-26T09:31:00.261538056Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792596933","title":"dovecot: Fix of CVE-2026-42007","description":"- CVE-2026-42007: pigeonhole: sieve editheader: reset header-index first pointers before rebuilding the index and copy raw header data with memcpy instead of i_strndup","status":"published","published":"2026-10-21T15:35:44Z","modified":"2026-10-26T09:31:20.365598785Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792753135","title":"dovecot: Fix of CVE-2026-42007","description":"- CVE-2026-42007: fix use-after-free and NUL-truncated header info leak in\n  bundled pigeonhole edit-mail","status":"published","published":"2026-10-23T10:59:05Z","modified":"2026-10-26T09:31:57.166134341Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792753365","title":"dovecot: Fix of CVE-2026-42007","description":"- CVE-2026-42007: fix use-after-free and NUL-truncated header info leak in\n  bundled pigeonhole edit-mail","status":"published","published":"2026-10-23T11:02:55Z","modified":"2026-10-26T09:32:01.269774139Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792764227","title":"dovecot: Fix of CVE-2026-42007","description":"- CVE-2026-42007: deliver the bundled pigeonhole edit-mail fix with direct\n  regressions for no-snapshot deletion and header replacement","status":"published","published":"2026-10-23T14:03:58Z","modified":"2026-10-26T09:31:57.380136718Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792764393","title":"dovecot: Fix of CVE-2026-42007","description":"- CVE-2026-42007: deliver the bundled pigeonhole edit-mail fix with direct\n  regressions for no-snapshot deletion and header replacement","status":"published","published":"2026-10-23T15:24:48Z","modified":"2026-10-26T09:32:01.388242529Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"MGASA-2026-0385","title":"Updated dovecot package fixes security vulnerabilities","description":"submission-login: Panic when mail_max_userip_connections is reached:\nPanic: epoll_ctl(del, 8) failed: Bad file descriptor. (CVE-2026-33263)\nDovecot IMAP LIST match_sub() Exponential Backtracking — CPU Denial of\nService. (CVE-2026-33607)\nDoS by sending mail with bad header. (CVE-2026-27852)\ndsync: Mail content can cause dsync protocol injection. (CVE-2026-33606)\nSMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return.\n(CVE-2026-33604)\nIMAP THREAD REFERENCES O(N²) CPU DoS via Crafted References Header\n(index-thread-links.c). (CVE-2026-40014)\npigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve\nCHECKSCRIPT/PUTSCRIPT. (CVE-2026-40013)\nmanagesieve-login: Pre-auth crash. (CVE-2026-33605)\nMySQL multi-byte escaping wrong. (CVE-2026-40018)\nv2.4.3 regression: managesieve-login pre-auth infinite loop.\n(CVE-2026-40019)\nimap-hibernate can be crashed. (CVE-2026-40015)\nIMAP THREAD O(M³) CPU DoS via CRC32 Hash Collision in strmap\n(mail-index-strmap.c / hash2.c). (CVE-2026-40017)\nIMAP Compression Can Reveal Whether a Small Synced Email Body Matches\nSender-Chosen Text. (CVE-2026-40203)\nSieve editheader RCE. (CVE-2026-42007)\nacl: lda_mailbox_autocreate can bypass acl restrictions.\n(CVE-2026-40204)\nOAuth2 passdb scope enforcement bypass via OR semantics in remote\nvalidation path. (CVE-2026-40205)\nXCLIENT FORWARD= bare token not namespaced, allows nopassword injection\nvia trusted proxy. (CVE-2026-42008)\nSingle NUL-Byte XCLIENT FORWARD Payload Crashes. (CVE-2026-42395)\ndoveadm_password or api key length can still be leaked with timing\ncomparisons. (CVE-2026-42393)\nSieve resource usage tracking lost when active script changes.\n(CVE-2026-52681)\nimap-urlauth leaks memory into user-visible error messages.\n(CVE-2026-42392)\nauth: db-oauth2: aud claim used as fallback for missing scope claim.\n(CVE-2026-73208)\nimap-login crash: Self-recursion on zero-output decompress chunks.\n(CVE-2026-73209)\nimap: Pre-login memory/CPU growth with ID command. (CVE-2026-42391)\nIMAP: COMPRESS ZSTD can cause excessive memory usage. (CVE-2026-52687)\n","status":"published","published":"2026-09-09T04:15:20Z","modified":"2026-09-09T04:42:22.817277874Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11629-1","title":"dovecot24-2.4.5-1.1 on GA media","description":"These are all security issues fixed in the dovecot24-2.4.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-28T00:00:00Z","modified":"2026-08-29T09:15:04.342434035Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21720-1","title":"Security update for dovecot24","description":"This update for dovecot24 fixes the following issues:\n\nUpdate to 2.4.5.\n\n- CVE-2026-33263: `submission-login`: panic when `mail_max_userip_connections` is reached (bsc#1276794).\n- CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799).\n- CVE-2026-33604: SMTP smuggling via missing dot-stuffing after bare carriage return (bsc#1276802).\n- CVE-2026-33605: `managesieve-login`: pre-auth crash (bsc#1276809).\n- CVE-2026-33606: `dsync`: mail content can cause `dsync` protocol injection (bsc#1276800).\n- CVE-2026-33607: IMAP `LIST` `match_sub()` exponential backtracking leading to CPU denial of service (bsc#1276795).\n- CVE-2026-40013: stack buffer underflow in `pigeonhole` `ManageSieve` `CHECKSCRIPT/PUTSCRIPT` (bsc#1276807).\n- CVE-2026-40014: CPU DoS via crafted references header (bsc#1276804).\n- CVE-2026-40015: `imap-hibernate` can be crashed (bsc#1276812).\n- CVE-2026-40017: CPU DoS via CRC32 hash collision in `strmap` (bsc#1276813).\n- CVE-2026-40018: MySQL multi-byte escaping performed incorrectly (bsc#1276810).\n- CVE-2026-40203: IMAP compression can reveal whether a small synced email body matches sender-chosen text\n  (bsc#1276815).\n- CVE-2026-40204: `lda_mailbox_autocreate` can bypass ACL restrictions (bsc#1276819).\n- CVE-2026-40205: OAuth2 `passdb` scope enforcement bypass via OR semantics in remote validation path (bsc#1276820).\n- CVE-2026-42007: `sieve` `editheader` RCE (bsc#1276817).\n- CVE-2026-42008: `XCLIENT FORWARD= bare` token not namespaced (bsc#1276824).\n- CVE-2026-42391: `imap`: pre-login memory/CPU growth with `ID` command (bsc#1276835).\n- CVE-2026-42392: `imap-urlauth` leaks memory into user-visible error messages (bsc#1276829).\n- CVE-2026-42393: `doveadm_password` or api key length can be leaked with timing comparisons (bsc#1276827).\n- CVE-2026-52687: `imap`: `COMPRESS ZSTD` can cause excessive memory usage (bsc#1276837).\n- CVE-2026-42395: single NUL-byte `XCLIENT FORWARD` payload crashes (bsc#1276826).\n- CVE-2026-52681: `sieve` resource usage tracking lost when active script changes (bsc#1276828).\n- CVE-2026-73208: `auth`: `db-oauth2`: `aud` claim used as fallback for missing scope claim (bsc#1276830).\n- CVE-2026-73209: `imap-login` crash due to self-recursion on zero-output decompress chunks (bsc#1276833).\n","status":"published","published":"2026-09-01T14:18:02Z","modified":"2026-09-02T18:00:03.64873556Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23595-1","title":"Security update for dovecot24","description":"This update for dovecot24 fixes the following issues:\n\nUpdate to 2.4.5.\n\n- CVE-2026-33263: `submission-login`: panic when `mail_max_userip_connections` is reached (bsc#1276794).\n- CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799).\n- CVE-2026-33604: SMTP smuggling via missing dot-stuffing after bare carriage return (bsc#1276802).\n- CVE-2026-33605: `managesieve-login`: pre-auth crash (bsc#1276809).\n- CVE-2026-33606: `dsync`: mail content can cause `dsync` protocol injection (bsc#1276800).\n- CVE-2026-33607: IMAP `LIST` `match_sub()` exponential backtracking leading to CPU denial of service (bsc#1276795).\n- CVE-2026-40013: stack buffer underflow in `pigeonhole` `ManageSieve` `CHECKSCRIPT/PUTSCRIPT` (bsc#1276807).\n- CVE-2026-40014: CPU DoS via crafted references header (bsc#1276804).\n- CVE-2026-40015: `imap-hibernate` can be crashed (bsc#1276812).\n- CVE-2026-40017: CPU DoS via CRC32 hash collision in `strmap` (bsc#1276813).\n- CVE-2026-40018: MySQL multi-byte escaping performed incorrectly (bsc#1276810).\n- CVE-2026-40203: IMAP compression can reveal whether a small synced email body matches sender-chosen text\n  (bsc#1276815).\n- CVE-2026-40204: `lda_mailbox_autocreate` can bypass ACL restrictions (bsc#1276819).\n- CVE-2026-40205: OAuth2 `passdb` scope enforcement bypass via OR semantics in remote validation path (bsc#1276820).\n- CVE-2026-42007: `sieve` `editheader` RCE (bsc#1276817).\n- CVE-2026-42008: `XCLIENT FORWARD= bare` token not namespaced (bsc#1276824).\n- CVE-2026-42391: `imap`: pre-login memory/CPU growth with `ID` command (bsc#1276835).\n- CVE-2026-42392: `imap-urlauth` leaks memory into user-visible error messages (bsc#1276829).\n- CVE-2026-42393: `doveadm_password` or api key length can be leaked with timing comparisons (bsc#1276827).\n- CVE-2026-52687: `imap`: `COMPRESS ZSTD` can cause excessive memory usage (bsc#1276837).\n- CVE-2026-42395: single NUL-byte `XCLIENT FORWARD` payload crashes (bsc#1276826).\n- CVE-2026-52681: `sieve` resource usage tracking lost when active script changes (bsc#1276828).\n- CVE-2026-73208: `auth`: `db-oauth2`: `aud` claim used as fallback for missing scope claim (bsc#1276830).\n- CVE-2026-73209: `imap-login` crash due to self-recursion on zero-output decompress chunks (bsc#1276833).\n","status":"published","published":"2026-09-01T14:12:16Z","modified":"2026-09-29T18:23:18.714105294Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3919-1","title":"Security update for dovecot22","description":"This update for dovecot22 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799).\n- CVE-2026-33604: SMTP smuggling via missing dot-stuffing after bare carriage return (bsc#1276802).\n- CVE-2026-33605: `managesieve-login`: pre-auth crash (bsc#1276809).\n- CVE-2026-33606: `dsync`: mail content can cause `dsync` protocol injection (bsc#1276800).\n- CVE-2026-33607: IMAP `LIST` `match_sub()` exponential backtracking leading to CPU denial of service (bsc#1276795).\n- CVE-2026-40014: CPU DoS via crafted references header (bsc#1276804).\n- CVE-2026-40015: `imap-hibernate` can be crashed (bsc#1276812).\n- CVE-2026-40019: `managesieve-login` pre-auth infinite loop (bsc#1276811).\n- CVE-2026-40203: IMAP compression can reveal whether a small synced email body matches sender-chosen text\n  (bsc#1276815).\n- CVE-2026-42007: `sieve` `editheader` RCE (bsc#1276817).\n- CVE-2026-42391: `imap`: pre-login memory/CPU growth with `ID` command (bsc#1276835).\n- CVE-2026-42393: `doveadm_password` or api key length can be leaked with timing comparisons (bsc#1276827).\n- CVE-2026-52687: `imap`: `COMPRESS ZSTD` can cause excessive memory usage (bsc#1276837).\n- CVE-2026-73209: `imap-login` crash due to self-recursion on zero-output decompress chunks (bsc#1276833).\n- multiple security fixes (bsc#1276792).\n\nOther updates and bugfixes:\n\n- Non-CVE hardening taken from the same upstream release:\n  * `sieve`: requiring the same extension repeatedly grew the default argument override chain, which is walked\n    recursively - a crafted script could overflow the stack\n  * `sieve`: `${unicode:...}` hex values could overflow an `unsigned int` and wrap back into the valid Unicode range;\n    the hex parser also read one byte past the end of the buffer\n  * `sieve` variables: the `${1234...}` numeric index overflowed a `signed int`\n  * `sieve enotify`: a single script could emit an unlimited number of notification messages; limited to 10 as upstream\n    does\n","status":"published","published":"2026-09-02T07:31:54Z","modified":"2026-09-10T18:23:19.872899569Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4139-1","title":"Security update for dovecot23","description":"This update for dovecot23 fixes the following issues:\n\n- CVE-2024-23184: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU\n  intensive (bsc#1229184).\n- CVE-2024-23185: large headers can cause resource exhaustion when parsing message (bsc#1229183).\n- CVE-2025-59028: Invalid base64 authentication can cause DoS for other logins (bsc#1260894).\n- CVE-2025-59031: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing\n  (bsc#1260895).\n- CVE-2025-59032: pigeonhole: ManageSieve panic occurs with sieve-connect as a client (bsc#1260902).\n- CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799).\n- CVE-2026-27855: OTP driver vulnerable to replay attack (bsc#1260900).\n- CVE-2026-27856: Doveadm credentials were not checked using timing-safe checking function (bsc#1260899).\n- CVE-2026-27857: sending excessive parenthesis causes imap-login to use excessive memory (bsc#1260898).\n- CVE-2026-27858: pigeonhole: managesieve-login can allocate large amount of memory during authentication (bsc#1260901).\n- CVE-2026-27859: excessive RFC 2231 MIME parameters in email would can excessive CPU usage (bsc#1260897).\n- CVE-2026-33263: submission-login: Panic when mail_max_userip_connections is reached (bsc#1276794).\n- CVE-2026-33603: login: base64 input can contain tabs that bypass IPC protection (bsc#1265147).\n- CVE-2026-33604: SMTP Smuggling via Missing Dot-Stuffing (bsc#1276802).\n- CVE-2026-33605: managesieve-login: Pre-auth crash (bsc#1276809).\n- CVE-2026-33606: dsync: Mail content can cause dsync protocol injection (bsc#1276800).\n- CVE-2026-33607: IMAP LIST match_sub() Exponential Backtracking -- CPU Denial of Service (bsc#1276795).\n- CVE-2026-40014: CPU DoS via Crafted References Header (bsc#1276804).\n- CVE-2026-40015: imap-hibernate can be crashed (bsc#1276812).\n- CVE-2026-40016: Sieve :contains/:matches O(NxM) substring match bypasses sieve_max_cpu_time limit (bsc#1265148).\n- CVE-2026-40019: managesieve-login pre-auth infinite loop (bsc#1276811).\n- CVE-2026-40020: IMAP folders can be shared-spammed to everyone (bsc#1265149).\n- CVE-2026-40203: IMAP Compression Can Reveal Whether a Small Synced Email Body Matches Sender-Chosen Text\n  (bsc#1276815).\n- CVE-2026-40205: OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path (bsc#1276820).\n- CVE-2026-42006: imap-login: uncontrolled memory usage with excessive bracing over IMAP (bsc#1265150).\n- CVE-2026-42007: editheader RCE (bsc#1276817).\n- CVE-2026-42008: XCLIENT FORWARD= bare token not namespaced (bsc#1276824).\n- CVE-2026-42391: imap: Pre-login memory/CPU growth with ID command (bsc#1276835).\n- CVE-2026-42393: doveadm_password or api key length can still be leaked with timing comparisons (bsc#1276827).\n- CVE-2026-42395: Single NUL-Byte XCLIENT FORWARD Payload Crashes (bsc#1276826).\n- CVE-2026-52681: Sieve resource usage tracking lost when active script changes (bsc#1276828).\n- CVE-2026-52687: IMAP: COMPRESS ZSTD can cause excessive memory usage (bsc#1276837).\n- CVE-2026-73208: auth: db-oauth2: aud claim used as fallback for missing scope claim (bsc#1276830).\n- CVE-2026-73209: imap-login crash: Self-recursion on zero-output decompress chunks (bsc#1276833).\n\nChanges for dovecot23:\n\n- Update to version 2.3.21.1.\n","status":"published","published":"2026-09-14T07:22:32Z","modified":"2026-09-28T18:23:12.561527353Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}