{"id":"CVE-2026-42008","aliases":["AZL-98325","DEBIAN-CVE-2026-42008","EUVD-2026-67673","GHSA-hwmp-h522-jmhg","MGASA-2026-0385","SUSE-SU-2026:23595-1","SUSE-SU-2026:4139-1","UBUNTU-CVE-2026-42008","openSUSE-SU-2026:21720-1"],"status":"published","title":"Forwarding information received from a host listed as a trusted proxy is not kept separate from...","description":"Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00236,"percentile":0.14637,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2026-08-28T00:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Debian:12","package":"dovecot","fixed_in":["1:2.3.19.1+dfsg1-2.1+deb12u7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dovecot","fixed_in":["1:2.4.1+dfsg1-6+deb13u7"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dovecot","fixed_in":["1:2.4.5+dfsg1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.20-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.19.1+dfsg1-2.1+deb12u7"}]}],"versions":["1:2.3.19.1+dfsg1-2.1","1:2.3.19.1+dfsg1-2.1+deb12u1","1:2.3.19.1+dfsg1-2.1+deb12u2","1:2.3.19.1+dfsg1-2.1+deb12u3","1:2.3.19.1+dfsg1-2.1+deb12u4","1:2.3.19.1+dfsg1-2.1+deb12u5","1:2.3.19.1+dfsg1-2.1+deb12u6"]},{"source":"osv","ecosystem":"Debian:13","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.1+dfsg1-6+deb13u7"}]}],"versions":["1:2.4.1+dfsg1-6","1:2.4.1+dfsg1-6+deb13u1","1:2.4.1+dfsg1-6+deb13u2","1:2.4.1+dfsg1-6+deb13u3","1:2.4.1+dfsg1-6+deb13u4","1:2.4.1+dfsg1-6+deb13u5","1:2.4.1+dfsg1-6+deb13u6"]},{"source":"osv","ecosystem":"Debian:14","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.5+dfsg1-1"}]}],"versions":["1:2.4.1+dfsg1-6","1:2.4.1+dfsg1-7","1:2.4.1+dfsg1-8","1:2.4.1+dfsg1-9","1:2.4.2+dfsg1-1","1:2.4.2+dfsg1-2","1:2.4.2+dfsg1-3","1:2.4.2+dfsg1-4","1:2.4.3+dfsg1-1","1:2.4.3+dfsg1-2","1:2.4.4+dfsg1-1","1:2.4.4+dfsg1-2"]},{"source":"osv","ecosystem":"Mageia:10","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-2.mga10"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-160000.2.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-160000.2.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.1.7-7ubuntu3","1:2.2.9-1ubuntu1","1:2.2.9-1ubuntu2","1:2.2.9-1ubuntu2.1","1:2.2.9-1ubuntu2.3","1:2.2.9-1ubuntu2.4","1:2.2.9-1ubuntu2.5","1:2.2.9-1ubuntu2.6","1:2.2.9-1ubuntu2.6+esm1","1:2.2.9-1ubuntu2.6+esm2","1:2.2.9-1ubuntu2.6+esm3","1:2.2.9-1ubuntu2.6+esm4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.2.18-2ubuntu2","1:2.2.22-1ubuntu1","1:2.2.22-1ubuntu2","1:2.2.22-1ubuntu2.1","1:2.2.22-1ubuntu2.2","1:2.2.22-1ubuntu2.3","1:2.2.22-1ubuntu2.4","1:2.2.22-1ubuntu2.6","1:2.2.22-1ubuntu2.7","1:2.2.22-1ubuntu2.8","1:2.2.22-1ubuntu2.9","1:2.2.22-1ubuntu2.10","1:2.2.22-1ubuntu2.11","1:2.2.22-1ubuntu2.12","1:2.2.22-1ubuntu2.13","1:2.2.22-1ubuntu2.14"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.2.27-3ubuntu1","1:2.2.33.2-1ubuntu1","1:2.2.33.2-1ubuntu2","1:2.2.33.2-1ubuntu3","1:2.2.33.2-1ubuntu4","1:2.2.33.2-1ubuntu4.1","1:2.2.33.2-1ubuntu4.2","1:2.2.33.2-1ubuntu4.3","1:2.2.33.2-1ubuntu4.4","1:2.2.33.2-1ubuntu4.5","1:2.2.33.2-1ubuntu4.6","1:2.2.33.2-1ubuntu4.7","1:2.2.33.2-1ubuntu4.8"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3.4.1-5ubuntu3","1:2.3.7.2-1ubuntu1","1:2.3.7.2-1ubuntu2","1:2.3.7.2-1ubuntu3","1:2.3.7.2-1ubuntu3.1","1:2.3.7.2-1ubuntu3.2","1:2.3.7.2-1ubuntu3.3","1:2.3.7.2-1ubuntu3.4","1:2.3.7.2-1ubuntu3.5","1:2.3.7.2-1ubuntu3.6","1:2.3.7.2-1ubuntu3.7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3.13+dfsg1-1ubuntu3","1:2.3.16+dfsg1-3ubuntu1","1:2.3.16+dfsg1-3ubuntu2","1:2.3.16+dfsg1-3ubuntu2.1","1:2.3.16+dfsg1-3ubuntu2.2","1:2.3.16+dfsg1-3ubuntu2.4","1:2.3.16+dfsg1-3ubuntu2.6","1:2.3.16+dfsg1-3ubuntu2.7","1:2.3.16+dfsg1-3ubuntu2.8","1:2.3.16+dfsg1-3ubuntu2.9"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3.20+dfsg1-1ubuntu3","1:2.3.21+dfsg1-2ubuntu1","1:2.3.21+dfsg1-2ubuntu2","1:2.3.21+dfsg1-2ubuntu4","1:2.3.21+dfsg1-2ubuntu5","1:2.3.21+dfsg1-2ubuntu6","1:2.3.21+dfsg1-2ubuntu6.1","1:2.3.21+dfsg1-2ubuntu6.2","1:2.3.21+dfsg1-2ubuntu6.3","1:2.3.21+dfsg1-2ubuntu6.4","1:2.3.21+dfsg1-2ubuntu6.5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.4.1+dfsg1-5ubuntu4","1:2.4.1+dfsg1-5ubuntu5","1:2.4.2+dfsg1-3ubuntu1","1:2.4.2+dfsg1-3ubuntu2","1:2.4.2+dfsg1-3ubuntu2.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-160000.2.1"}]}],"bundled":24}],"products":[{"vendor":"open-xchange gmbh","product":"ox dovecot ce"},{"vendor":"open-xchange gmbh","product":"ox dovecot pro"}],"references":[{"url":"https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42008","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hwmp-h522-jmhg"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-42008","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0385.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36219","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/28/1","tags":["web"]},{"url":"https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623595-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276794","tags":["report"]},{"url":"https://bugzilla.suse.com/1276795","tags":["report"]},{"url":"https://bugzilla.suse.com/1276799","tags":["report"]},{"url":"https://bugzilla.suse.com/1276800","tags":["report"]},{"url":"https://bugzilla.suse.com/1276802","tags":["report"]},{"url":"https://bugzilla.suse.com/1276804","tags":["report"]},{"url":"https://bugzilla.suse.com/1276807","tags":["report"]},{"url":"https://bugzilla.suse.com/1276809","tags":["report"]},{"url":"https://bugzilla.suse.com/1276810","tags":["report"]},{"url":"https://bugzilla.suse.com/1276812","tags":["report"]},{"url":"https://bugzilla.suse.com/1276813","tags":["report"]},{"url":"https://bugzilla.suse.com/1276815","tags":["report"]},{"url":"https://bugzilla.suse.com/1276817","tags":["report"]},{"url":"https://bugzilla.suse.com/1276819","tags":["report"]},{"url":"https://bugzilla.suse.com/1276820","tags":["report"]},{"url":"https://bugzilla.suse.com/1276824","tags":["report"]},{"url":"https://bugzilla.suse.com/1276826","tags":["report"]},{"url":"https://bugzilla.suse.com/1276827","tags":["report"]},{"url":"https://bugzilla.suse.com/1276828","tags":["report"]},{"url":"https://bugzilla.suse.com/1276829","tags":["report"]},{"url":"https://bugzilla.suse.com/1276830","tags":["report"]},{"url":"https://bugzilla.suse.com/1276833","tags":["report"]},{"url":"https://bugzilla.suse.com/1276835","tags":["report"]},{"url":"https://bugzilla.suse.com/1276837","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73209","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264139-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1229183","tags":["report"]},{"url":"https://bugzilla.suse.com/1229184","tags":["report"]},{"url":"https://bugzilla.suse.com/1260894","tags":["report"]},{"url":"https://bugzilla.suse.com/1260895","tags":["report"]},{"url":"https://bugzilla.suse.com/1260897","tags":["report"]},{"url":"https://bugzilla.suse.com/1260898","tags":["report"]},{"url":"https://bugzilla.suse.com/1260899","tags":["report"]},{"url":"https://bugzilla.suse.com/1260900","tags":["report"]},{"url":"https://bugzilla.suse.com/1260901","tags":["report"]},{"url":"https://bugzilla.suse.com/1260902","tags":["report"]},{"url":"https://bugzilla.suse.com/1265147","tags":["report"]},{"url":"https://bugzilla.suse.com/1265148","tags":["report"]},{"url":"https://bugzilla.suse.com/1265149","tags":["report"]},{"url":"https://bugzilla.suse.com/1265150","tags":["report"]},{"url":"https://bugzilla.suse.com/1276811","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42006","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-42008","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42008","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-42008","description":"Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T10:12:26.018Z","modified":"2026-08-28T15:54:17.203Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T13:40:35.004553Z"}],"euvd":[{"id":"EUVD-2026-67673","description":"Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T10:12:26Z","modified":"2026-08-28T15:54:17Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:23.104802Z"}],"ghsa":[{"id":"GHSA-hwmp-h522-jmhg","title":"Forwarding information received from a host listed as a trusted proxy is not kept separate from...","description":"Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T12:30:25Z","modified":"2026-08-28T12:30:26Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:11:06.970333Z"}],"nvd":[{"id":"CVE-2026-42008","description":"Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T12:16:29.38Z","modified":"2026-09-03T18:13:44.643Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:12:42.366888Z"}],"osv":[{"id":"DEBIAN-CVE-2026-42008","description":"Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T12:16:29.38Z","modified":"2026-10-31T16:04:23.68494913Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"UBUNTU-CVE-2026-42008","description":"Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T00:00:00Z","modified":"2026-09-02T19:36:04.709783619Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"AZL-98325","title":"CVE-2026-42008 affecting package dovecot 2.3.20-1","description":"Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T12:16:29Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"MGASA-2026-0385","title":"Updated dovecot package fixes security vulnerabilities","description":"submission-login: Panic when mail_max_userip_connections is reached:\nPanic: epoll_ctl(del, 8) failed: Bad file descriptor. (CVE-2026-33263)\nDovecot IMAP LIST match_sub() Exponential Backtracking — CPU Denial of\nService. (CVE-2026-33607)\nDoS by sending mail with bad header. (CVE-2026-27852)\ndsync: Mail content can cause dsync protocol injection. (CVE-2026-33606)\nSMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return.\n(CVE-2026-33604)\nIMAP THREAD REFERENCES O(N²) CPU DoS via Crafted References Header\n(index-thread-links.c). (CVE-2026-40014)\npigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve\nCHECKSCRIPT/PUTSCRIPT. (CVE-2026-40013)\nmanagesieve-login: Pre-auth crash. (CVE-2026-33605)\nMySQL multi-byte escaping wrong. (CVE-2026-40018)\nv2.4.3 regression: managesieve-login pre-auth infinite loop.\n(CVE-2026-40019)\nimap-hibernate can be crashed. (CVE-2026-40015)\nIMAP THREAD O(M³) CPU DoS via CRC32 Hash Collision in strmap\n(mail-index-strmap.c / hash2.c). (CVE-2026-40017)\nIMAP Compression Can Reveal Whether a Small Synced Email Body Matches\nSender-Chosen Text. (CVE-2026-40203)\nSieve editheader RCE. (CVE-2026-42007)\nacl: lda_mailbox_autocreate can bypass acl restrictions.\n(CVE-2026-40204)\nOAuth2 passdb scope enforcement bypass via OR semantics in remote\nvalidation path. (CVE-2026-40205)\nXCLIENT FORWARD= bare token not namespaced, allows nopassword injection\nvia trusted proxy. (CVE-2026-42008)\nSingle NUL-Byte XCLIENT FORWARD Payload Crashes. (CVE-2026-42395)\ndoveadm_password or api key length can still be leaked with timing\ncomparisons. (CVE-2026-42393)\nSieve resource usage tracking lost when active script changes.\n(CVE-2026-52681)\nimap-urlauth leaks memory into user-visible error messages.\n(CVE-2026-42392)\nauth: db-oauth2: aud claim used as fallback for missing scope claim.\n(CVE-2026-73208)\nimap-login crash: Self-recursion on zero-output decompress chunks.\n(CVE-2026-73209)\nimap: Pre-login memory/CPU growth with ID command. (CVE-2026-42391)\nIMAP: COMPRESS ZSTD can cause excessive memory usage. (CVE-2026-52687)\n","status":"published","published":"2026-09-09T04:15:20Z","modified":"2026-09-09T04:42:22.817277874Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:21720-1","title":"Security update for dovecot24","description":"This update for dovecot24 fixes the following issues:\n\nUpdate to 2.4.5.\n\n- CVE-2026-33263: `submission-login`: panic when `mail_max_userip_connections` is reached (bsc#1276794).\n- CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799).\n- CVE-2026-33604: SMTP smuggling via missing dot-stuffing after bare carriage return (bsc#1276802).\n- CVE-2026-33605: `managesieve-login`: pre-auth crash (bsc#1276809).\n- CVE-2026-33606: `dsync`: mail content can cause `dsync` protocol injection (bsc#1276800).\n- CVE-2026-33607: IMAP `LIST` `match_sub()` exponential backtracking leading to CPU denial of service (bsc#1276795).\n- CVE-2026-40013: stack buffer underflow in `pigeonhole` `ManageSieve` `CHECKSCRIPT/PUTSCRIPT` (bsc#1276807).\n- CVE-2026-40014: CPU DoS via crafted references header (bsc#1276804).\n- CVE-2026-40015: `imap-hibernate` can be crashed (bsc#1276812).\n- CVE-2026-40017: CPU DoS via CRC32 hash collision in `strmap` (bsc#1276813).\n- CVE-2026-40018: MySQL multi-byte escaping performed incorrectly (bsc#1276810).\n- CVE-2026-40203: IMAP compression can reveal whether a small synced email body matches sender-chosen text\n  (bsc#1276815).\n- CVE-2026-40204: `lda_mailbox_autocreate` can bypass ACL restrictions (bsc#1276819).\n- CVE-2026-40205: OAuth2 `passdb` scope enforcement bypass via OR semantics in remote validation path (bsc#1276820).\n- CVE-2026-42007: `sieve` `editheader` RCE (bsc#1276817).\n- CVE-2026-42008: `XCLIENT FORWARD= bare` token not namespaced (bsc#1276824).\n- CVE-2026-42391: `imap`: pre-login memory/CPU growth with `ID` command (bsc#1276835).\n- CVE-2026-42392: `imap-urlauth` leaks memory into user-visible error messages (bsc#1276829).\n- CVE-2026-42393: `doveadm_password` or api key length can be leaked with timing comparisons (bsc#1276827).\n- CVE-2026-52687: `imap`: `COMPRESS ZSTD` can cause excessive memory usage (bsc#1276837).\n- CVE-2026-42395: single NUL-byte `XCLIENT FORWARD` payload crashes (bsc#1276826).\n- CVE-2026-52681: `sieve` resource usage tracking lost when active script changes (bsc#1276828).\n- CVE-2026-73208: `auth`: `db-oauth2`: `aud` claim used as fallback for missing scope claim (bsc#1276830).\n- CVE-2026-73209: `imap-login` crash due to self-recursion on zero-output decompress chunks (bsc#1276833).\n","status":"published","published":"2026-09-01T14:18:02Z","modified":"2026-09-02T18:00:03.64873556Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23595-1","title":"Security update for dovecot24","description":"This update for dovecot24 fixes the following issues:\n\nUpdate to 2.4.5.\n\n- CVE-2026-33263: `submission-login`: panic when `mail_max_userip_connections` is reached (bsc#1276794).\n- CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799).\n- CVE-2026-33604: SMTP smuggling via missing dot-stuffing after bare carriage return (bsc#1276802).\n- CVE-2026-33605: `managesieve-login`: pre-auth crash (bsc#1276809).\n- CVE-2026-33606: `dsync`: mail content can cause `dsync` protocol injection (bsc#1276800).\n- CVE-2026-33607: IMAP `LIST` `match_sub()` exponential backtracking leading to CPU denial of service (bsc#1276795).\n- CVE-2026-40013: stack buffer underflow in `pigeonhole` `ManageSieve` `CHECKSCRIPT/PUTSCRIPT` (bsc#1276807).\n- CVE-2026-40014: CPU DoS via crafted references header (bsc#1276804).\n- CVE-2026-40015: `imap-hibernate` can be crashed (bsc#1276812).\n- CVE-2026-40017: CPU DoS via CRC32 hash collision in `strmap` (bsc#1276813).\n- CVE-2026-40018: MySQL multi-byte escaping performed incorrectly (bsc#1276810).\n- CVE-2026-40203: IMAP compression can reveal whether a small synced email body matches sender-chosen text\n  (bsc#1276815).\n- CVE-2026-40204: `lda_mailbox_autocreate` can bypass ACL restrictions (bsc#1276819).\n- CVE-2026-40205: OAuth2 `passdb` scope enforcement bypass via OR semantics in remote validation path (bsc#1276820).\n- CVE-2026-42007: `sieve` `editheader` RCE (bsc#1276817).\n- CVE-2026-42008: `XCLIENT FORWARD= bare` token not namespaced (bsc#1276824).\n- CVE-2026-42391: `imap`: pre-login memory/CPU growth with `ID` command (bsc#1276835).\n- CVE-2026-42392: `imap-urlauth` leaks memory into user-visible error messages (bsc#1276829).\n- CVE-2026-42393: `doveadm_password` or api key length can be leaked with timing comparisons (bsc#1276827).\n- CVE-2026-52687: `imap`: `COMPRESS ZSTD` can cause excessive memory usage (bsc#1276837).\n- CVE-2026-42395: single NUL-byte `XCLIENT FORWARD` payload crashes (bsc#1276826).\n- CVE-2026-52681: `sieve` resource usage tracking lost when active script changes (bsc#1276828).\n- CVE-2026-73208: `auth`: `db-oauth2`: `aud` claim used as fallback for missing scope claim (bsc#1276830).\n- CVE-2026-73209: `imap-login` crash due to self-recursion on zero-output decompress chunks (bsc#1276833).\n","status":"published","published":"2026-09-01T14:12:16Z","modified":"2026-09-29T18:23:18.714105294Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:4139-1","title":"Security update for dovecot23","description":"This update for dovecot23 fixes the following issues:\n\n- CVE-2024-23184: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU\n  intensive (bsc#1229184).\n- CVE-2024-23185: large headers can cause resource exhaustion when parsing message (bsc#1229183).\n- CVE-2025-59028: Invalid base64 authentication can cause DoS for other logins (bsc#1260894).\n- CVE-2025-59031: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing\n  (bsc#1260895).\n- CVE-2025-59032: pigeonhole: ManageSieve panic occurs with sieve-connect as a client (bsc#1260902).\n- CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799).\n- CVE-2026-27855: OTP driver vulnerable to replay attack (bsc#1260900).\n- CVE-2026-27856: Doveadm credentials were not checked using timing-safe checking function (bsc#1260899).\n- CVE-2026-27857: sending excessive parenthesis causes imap-login to use excessive memory (bsc#1260898).\n- CVE-2026-27858: pigeonhole: managesieve-login can allocate large amount of memory during authentication (bsc#1260901).\n- CVE-2026-27859: excessive RFC 2231 MIME parameters in email would can excessive CPU usage (bsc#1260897).\n- CVE-2026-33263: submission-login: Panic when mail_max_userip_connections is reached (bsc#1276794).\n- CVE-2026-33603: login: base64 input can contain tabs that bypass IPC protection (bsc#1265147).\n- CVE-2026-33604: SMTP Smuggling via Missing Dot-Stuffing (bsc#1276802).\n- CVE-2026-33605: managesieve-login: Pre-auth crash (bsc#1276809).\n- CVE-2026-33606: dsync: Mail content can cause dsync protocol injection (bsc#1276800).\n- CVE-2026-33607: IMAP LIST match_sub() Exponential Backtracking -- CPU Denial of Service (bsc#1276795).\n- CVE-2026-40014: CPU DoS via Crafted References Header (bsc#1276804).\n- CVE-2026-40015: imap-hibernate can be crashed (bsc#1276812).\n- CVE-2026-40016: Sieve :contains/:matches O(NxM) substring match bypasses sieve_max_cpu_time limit (bsc#1265148).\n- CVE-2026-40019: managesieve-login pre-auth infinite loop (bsc#1276811).\n- CVE-2026-40020: IMAP folders can be shared-spammed to everyone (bsc#1265149).\n- CVE-2026-40203: IMAP Compression Can Reveal Whether a Small Synced Email Body Matches Sender-Chosen Text\n  (bsc#1276815).\n- CVE-2026-40205: OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path (bsc#1276820).\n- CVE-2026-42006: imap-login: uncontrolled memory usage with excessive bracing over IMAP (bsc#1265150).\n- CVE-2026-42007: editheader RCE (bsc#1276817).\n- CVE-2026-42008: XCLIENT FORWARD= bare token not namespaced (bsc#1276824).\n- CVE-2026-42391: imap: Pre-login memory/CPU growth with ID command (bsc#1276835).\n- CVE-2026-42393: doveadm_password or api key length can still be leaked with timing comparisons (bsc#1276827).\n- CVE-2026-42395: Single NUL-Byte XCLIENT FORWARD Payload Crashes (bsc#1276826).\n- CVE-2026-52681: Sieve resource usage tracking lost when active script changes (bsc#1276828).\n- CVE-2026-52687: IMAP: COMPRESS ZSTD can cause excessive memory usage (bsc#1276837).\n- CVE-2026-73208: auth: db-oauth2: aud claim used as fallback for missing scope claim (bsc#1276830).\n- CVE-2026-73209: imap-login crash: Self-recursion on zero-output decompress chunks (bsc#1276833).\n\nChanges for dovecot23:\n\n- Update to version 2.3.21.1.\n","status":"published","published":"2026-09-14T07:22:32Z","modified":"2026-09-28T18:23:12.561527353Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}