{"id":"CVE-2026-42392","aliases":["ALPINE-CVE-2026-42392","AZL-98277","DEBIAN-CVE-2026-42392","EUVD-2026-67675","GHSA-cq8p-2j3r-5hxq","MGASA-2026-0385","SUSE-SU-2026:23595-1","UBUNTU-CVE-2026-42392","openSUSE-SU-2026:11629-1","openSUSE-SU-2026:21720-1"],"status":"published","title":"An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes...","description":"An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH functionality. Update to non-vulnerable version. No publicly available exploits are known.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0027,"percentile":0.1937,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2026-08-28T00:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"dovecot","fixed_in":["2.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"dovecot","fixed_in":["2.4.5-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dovecot","fixed_in":["1:2.4.1+dfsg1-6+deb13u7"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dovecot","fixed_in":["1:2.4.5+dfsg1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.20-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.1+dfsg1-6+deb13u7"}]}],"versions":["1:2.4.1+dfsg1-6","1:2.4.1+dfsg1-6+deb13u1","1:2.4.1+dfsg1-6+deb13u2","1:2.4.1+dfsg1-6+deb13u3","1:2.4.1+dfsg1-6+deb13u4","1:2.4.1+dfsg1-6+deb13u5","1:2.4.1+dfsg1-6+deb13u6"]},{"source":"osv","ecosystem":"Debian:14","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.5+dfsg1-1"}]}],"versions":["1:2.4.1+dfsg1-6","1:2.4.1+dfsg1-7","1:2.4.1+dfsg1-8","1:2.4.1+dfsg1-9","1:2.4.2+dfsg1-1","1:2.4.2+dfsg1-2","1:2.4.2+dfsg1-3","1:2.4.2+dfsg1-4","1:2.4.3+dfsg1-1","1:2.4.3+dfsg1-2","1:2.4.4+dfsg1-1","1:2.4.4+dfsg1-2"]},{"source":"osv","ecosystem":"Mageia:10","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-2.mga10"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-160000.2.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-160000.2.1"}]}],"bundled":24},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.1.7-7ubuntu3","1:2.2.9-1ubuntu1","1:2.2.9-1ubuntu2","1:2.2.9-1ubuntu2.1","1:2.2.9-1ubuntu2.3","1:2.2.9-1ubuntu2.4","1:2.2.9-1ubuntu2.5","1:2.2.9-1ubuntu2.6","1:2.2.9-1ubuntu2.6+esm1","1:2.2.9-1ubuntu2.6+esm2","1:2.2.9-1ubuntu2.6+esm3","1:2.2.9-1ubuntu2.6+esm4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.2.18-2ubuntu2","1:2.2.22-1ubuntu1","1:2.2.22-1ubuntu2","1:2.2.22-1ubuntu2.1","1:2.2.22-1ubuntu2.2","1:2.2.22-1ubuntu2.3","1:2.2.22-1ubuntu2.4","1:2.2.22-1ubuntu2.6","1:2.2.22-1ubuntu2.7","1:2.2.22-1ubuntu2.8","1:2.2.22-1ubuntu2.9","1:2.2.22-1ubuntu2.10","1:2.2.22-1ubuntu2.11","1:2.2.22-1ubuntu2.12","1:2.2.22-1ubuntu2.13","1:2.2.22-1ubuntu2.14"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.2.27-3ubuntu1","1:2.2.33.2-1ubuntu1","1:2.2.33.2-1ubuntu2","1:2.2.33.2-1ubuntu3","1:2.2.33.2-1ubuntu4","1:2.2.33.2-1ubuntu4.1","1:2.2.33.2-1ubuntu4.2","1:2.2.33.2-1ubuntu4.3","1:2.2.33.2-1ubuntu4.4","1:2.2.33.2-1ubuntu4.5","1:2.2.33.2-1ubuntu4.6","1:2.2.33.2-1ubuntu4.7","1:2.2.33.2-1ubuntu4.8"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3.4.1-5ubuntu3","1:2.3.7.2-1ubuntu1","1:2.3.7.2-1ubuntu2","1:2.3.7.2-1ubuntu3","1:2.3.7.2-1ubuntu3.1","1:2.3.7.2-1ubuntu3.2","1:2.3.7.2-1ubuntu3.3","1:2.3.7.2-1ubuntu3.4","1:2.3.7.2-1ubuntu3.5","1:2.3.7.2-1ubuntu3.6","1:2.3.7.2-1ubuntu3.7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3.13+dfsg1-1ubuntu3","1:2.3.16+dfsg1-3ubuntu1","1:2.3.16+dfsg1-3ubuntu2","1:2.3.16+dfsg1-3ubuntu2.1","1:2.3.16+dfsg1-3ubuntu2.2","1:2.3.16+dfsg1-3ubuntu2.4","1:2.3.16+dfsg1-3ubuntu2.6","1:2.3.16+dfsg1-3ubuntu2.7","1:2.3.16+dfsg1-3ubuntu2.8","1:2.3.16+dfsg1-3ubuntu2.9"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3.20+dfsg1-1ubuntu3","1:2.3.21+dfsg1-2ubuntu1","1:2.3.21+dfsg1-2ubuntu2","1:2.3.21+dfsg1-2ubuntu4","1:2.3.21+dfsg1-2ubuntu5","1:2.3.21+dfsg1-2ubuntu6","1:2.3.21+dfsg1-2ubuntu6.1","1:2.3.21+dfsg1-2ubuntu6.2","1:2.3.21+dfsg1-2ubuntu6.3","1:2.3.21+dfsg1-2ubuntu6.4","1:2.3.21+dfsg1-2ubuntu6.5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.4.1+dfsg1-5ubuntu4","1:2.4.1+dfsg1-5ubuntu5","1:2.4.2+dfsg1-3ubuntu1","1:2.4.2+dfsg1-3ubuntu2","1:2.4.2+dfsg1-3ubuntu2.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-1.1"}]}],"bundled":22},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-160000.2.1"}]}],"bundled":24}],"products":[{"vendor":"open-xchange gmbh","product":"ox dovecot ce"},{"vendor":"open-xchange gmbh","product":"ox dovecot pro"}],"references":[{"url":"https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42392","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cq8p-2j3r-5hxq"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-42392","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-42392","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0385.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36219","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/28/1","tags":["web"]},{"url":"https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623595-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276794","tags":["report"]},{"url":"https://bugzilla.suse.com/1276795","tags":["report"]},{"url":"https://bugzilla.suse.com/1276799","tags":["report"]},{"url":"https://bugzilla.suse.com/1276800","tags":["report"]},{"url":"https://bugzilla.suse.com/1276802","tags":["report"]},{"url":"https://bugzilla.suse.com/1276804","tags":["report"]},{"url":"https://bugzilla.suse.com/1276807","tags":["report"]},{"url":"https://bugzilla.suse.com/1276809","tags":["report"]},{"url":"https://bugzilla.suse.com/1276810","tags":["report"]},{"url":"https://bugzilla.suse.com/1276812","tags":["report"]},{"url":"https://bugzilla.suse.com/1276813","tags":["report"]},{"url":"https://bugzilla.suse.com/1276815","tags":["report"]},{"url":"https://bugzilla.suse.com/1276817","tags":["report"]},{"url":"https://bugzilla.suse.com/1276819","tags":["report"]},{"url":"https://bugzilla.suse.com/1276820","tags":["report"]},{"url":"https://bugzilla.suse.com/1276824","tags":["report"]},{"url":"https://bugzilla.suse.com/1276826","tags":["report"]},{"url":"https://bugzilla.suse.com/1276827","tags":["report"]},{"url":"https://bugzilla.suse.com/1276828","tags":["report"]},{"url":"https://bugzilla.suse.com/1276829","tags":["report"]},{"url":"https://bugzilla.suse.com/1276830","tags":["report"]},{"url":"https://bugzilla.suse.com/1276833","tags":["report"]},{"url":"https://bugzilla.suse.com/1276835","tags":["report"]},{"url":"https://bugzilla.suse.com/1276837","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73209","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-42392","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42392","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4200","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-42392","description":"An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH functionality. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T10:12:27.979Z","modified":"2026-08-28T15:53:58.772Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T13:40:35.004553Z"}],"euvd":[{"id":"EUVD-2026-67675","description":"An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH functionality. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T10:12:27Z","modified":"2026-08-28T15:53:58Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:23.104802Z"}],"ghsa":[{"id":"GHSA-cq8p-2j3r-5hxq","title":"An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes...","description":"An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH functionality. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T12:30:25Z","modified":"2026-08-28T12:30:35Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:11:06.970333Z"}],"nvd":[{"id":"CVE-2026-42392","description":"An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH functionality. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T12:16:29.64Z","modified":"2026-09-03T18:13:44.643Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:42.366888Z"}],"osv":[{"id":"ALPINE-CVE-2026-42392","description":"An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH functionality. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T12:16:29.64Z","modified":"2026-10-01T02:17:49.291944593Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"DEBIAN-CVE-2026-42392","description":"An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH functionality. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T12:16:29.64Z","modified":"2026-10-01T03:03:11.861956304Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"UBUNTU-CVE-2026-42392","description":"An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH functionality. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T00:00:00Z","modified":"2026-09-02T19:36:05.488550685Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"AZL-98277","title":"CVE-2026-42392 affecting package dovecot 2.3.20-1","description":"An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH functionality. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T12:16:29Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"MGASA-2026-0385","title":"Updated dovecot package fixes security vulnerabilities","description":"submission-login: Panic when mail_max_userip_connections is reached:\nPanic: epoll_ctl(del, 8) failed: Bad file descriptor. (CVE-2026-33263)\nDovecot IMAP LIST match_sub() Exponential Backtracking — CPU Denial of\nService. (CVE-2026-33607)\nDoS by sending mail with bad header. (CVE-2026-27852)\ndsync: Mail content can cause dsync protocol injection. (CVE-2026-33606)\nSMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return.\n(CVE-2026-33604)\nIMAP THREAD REFERENCES O(N²) CPU DoS via Crafted References Header\n(index-thread-links.c). (CVE-2026-40014)\npigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve\nCHECKSCRIPT/PUTSCRIPT. (CVE-2026-40013)\nmanagesieve-login: Pre-auth crash. (CVE-2026-33605)\nMySQL multi-byte escaping wrong. (CVE-2026-40018)\nv2.4.3 regression: managesieve-login pre-auth infinite loop.\n(CVE-2026-40019)\nimap-hibernate can be crashed. (CVE-2026-40015)\nIMAP THREAD O(M³) CPU DoS via CRC32 Hash Collision in strmap\n(mail-index-strmap.c / hash2.c). (CVE-2026-40017)\nIMAP Compression Can Reveal Whether a Small Synced Email Body Matches\nSender-Chosen Text. (CVE-2026-40203)\nSieve editheader RCE. (CVE-2026-42007)\nacl: lda_mailbox_autocreate can bypass acl restrictions.\n(CVE-2026-40204)\nOAuth2 passdb scope enforcement bypass via OR semantics in remote\nvalidation path. (CVE-2026-40205)\nXCLIENT FORWARD= bare token not namespaced, allows nopassword injection\nvia trusted proxy. (CVE-2026-42008)\nSingle NUL-Byte XCLIENT FORWARD Payload Crashes. (CVE-2026-42395)\ndoveadm_password or api key length can still be leaked with timing\ncomparisons. (CVE-2026-42393)\nSieve resource usage tracking lost when active script changes.\n(CVE-2026-52681)\nimap-urlauth leaks memory into user-visible error messages.\n(CVE-2026-42392)\nauth: db-oauth2: aud claim used as fallback for missing scope claim.\n(CVE-2026-73208)\nimap-login crash: Self-recursion on zero-output decompress chunks.\n(CVE-2026-73209)\nimap: Pre-login memory/CPU growth with ID command. (CVE-2026-42391)\nIMAP: COMPRESS ZSTD can cause excessive memory usage. (CVE-2026-52687)\n","status":"published","published":"2026-09-09T04:15:20Z","modified":"2026-09-09T04:42:22.817277874Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11629-1","title":"dovecot24-2.4.5-1.1 on GA media","description":"These are all security issues fixed in the dovecot24-2.4.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-28T00:00:00Z","modified":"2026-08-29T09:15:04.342434035Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21720-1","title":"Security update for dovecot24","description":"This update for dovecot24 fixes the following issues:\n\nUpdate to 2.4.5.\n\n- CVE-2026-33263: `submission-login`: panic when `mail_max_userip_connections` is reached (bsc#1276794).\n- CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799).\n- CVE-2026-33604: SMTP smuggling via missing dot-stuffing after bare carriage return (bsc#1276802).\n- CVE-2026-33605: `managesieve-login`: pre-auth crash (bsc#1276809).\n- CVE-2026-33606: `dsync`: mail content can cause `dsync` protocol injection (bsc#1276800).\n- CVE-2026-33607: IMAP `LIST` `match_sub()` exponential backtracking leading to CPU denial of service (bsc#1276795).\n- CVE-2026-40013: stack buffer underflow in `pigeonhole` `ManageSieve` `CHECKSCRIPT/PUTSCRIPT` (bsc#1276807).\n- CVE-2026-40014: CPU DoS via crafted references header (bsc#1276804).\n- CVE-2026-40015: `imap-hibernate` can be crashed (bsc#1276812).\n- CVE-2026-40017: CPU DoS via CRC32 hash collision in `strmap` (bsc#1276813).\n- CVE-2026-40018: MySQL multi-byte escaping performed incorrectly (bsc#1276810).\n- CVE-2026-40203: IMAP compression can reveal whether a small synced email body matches sender-chosen text\n  (bsc#1276815).\n- CVE-2026-40204: `lda_mailbox_autocreate` can bypass ACL restrictions (bsc#1276819).\n- CVE-2026-40205: OAuth2 `passdb` scope enforcement bypass via OR semantics in remote validation path (bsc#1276820).\n- CVE-2026-42007: `sieve` `editheader` RCE (bsc#1276817).\n- CVE-2026-42008: `XCLIENT FORWARD= bare` token not namespaced (bsc#1276824).\n- CVE-2026-42391: `imap`: pre-login memory/CPU growth with `ID` command (bsc#1276835).\n- CVE-2026-42392: `imap-urlauth` leaks memory into user-visible error messages (bsc#1276829).\n- CVE-2026-42393: `doveadm_password` or api key length can be leaked with timing comparisons (bsc#1276827).\n- CVE-2026-52687: `imap`: `COMPRESS ZSTD` can cause excessive memory usage (bsc#1276837).\n- CVE-2026-42395: single NUL-byte `XCLIENT FORWARD` payload crashes (bsc#1276826).\n- CVE-2026-52681: `sieve` resource usage tracking lost when active script changes (bsc#1276828).\n- CVE-2026-73208: `auth`: `db-oauth2`: `aud` claim used as fallback for missing scope claim (bsc#1276830).\n- CVE-2026-73209: `imap-login` crash due to self-recursion on zero-output decompress chunks (bsc#1276833).\n","status":"published","published":"2026-09-01T14:18:02Z","modified":"2026-09-02T18:00:03.64873556Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23595-1","title":"Security update for dovecot24","description":"This update for dovecot24 fixes the following issues:\n\nUpdate to 2.4.5.\n\n- CVE-2026-33263: `submission-login`: panic when `mail_max_userip_connections` is reached (bsc#1276794).\n- CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799).\n- CVE-2026-33604: SMTP smuggling via missing dot-stuffing after bare carriage return (bsc#1276802).\n- CVE-2026-33605: `managesieve-login`: pre-auth crash (bsc#1276809).\n- CVE-2026-33606: `dsync`: mail content can cause `dsync` protocol injection (bsc#1276800).\n- CVE-2026-33607: IMAP `LIST` `match_sub()` exponential backtracking leading to CPU denial of service (bsc#1276795).\n- CVE-2026-40013: stack buffer underflow in `pigeonhole` `ManageSieve` `CHECKSCRIPT/PUTSCRIPT` (bsc#1276807).\n- CVE-2026-40014: CPU DoS via crafted references header (bsc#1276804).\n- CVE-2026-40015: `imap-hibernate` can be crashed (bsc#1276812).\n- CVE-2026-40017: CPU DoS via CRC32 hash collision in `strmap` (bsc#1276813).\n- CVE-2026-40018: MySQL multi-byte escaping performed incorrectly (bsc#1276810).\n- CVE-2026-40203: IMAP compression can reveal whether a small synced email body matches sender-chosen text\n  (bsc#1276815).\n- CVE-2026-40204: `lda_mailbox_autocreate` can bypass ACL restrictions (bsc#1276819).\n- CVE-2026-40205: OAuth2 `passdb` scope enforcement bypass via OR semantics in remote validation path (bsc#1276820).\n- CVE-2026-42007: `sieve` `editheader` RCE (bsc#1276817).\n- CVE-2026-42008: `XCLIENT FORWARD= bare` token not namespaced (bsc#1276824).\n- CVE-2026-42391: `imap`: pre-login memory/CPU growth with `ID` command (bsc#1276835).\n- CVE-2026-42392: `imap-urlauth` leaks memory into user-visible error messages (bsc#1276829).\n- CVE-2026-42393: `doveadm_password` or api key length can be leaked with timing comparisons (bsc#1276827).\n- CVE-2026-52687: `imap`: `COMPRESS ZSTD` can cause excessive memory usage (bsc#1276837).\n- CVE-2026-42395: single NUL-byte `XCLIENT FORWARD` payload crashes (bsc#1276826).\n- CVE-2026-52681: `sieve` resource usage tracking lost when active script changes (bsc#1276828).\n- CVE-2026-73208: `auth`: `db-oauth2`: `aud` claim used as fallback for missing scope claim (bsc#1276830).\n- CVE-2026-73209: `imap-login` crash due to self-recursion on zero-output decompress chunks (bsc#1276833).\n","status":"published","published":"2026-09-01T14:12:16Z","modified":"2026-09-29T18:23:18.714105294Z","updated_at":"2026-11-02T15:54:03.991985Z"}]}}