{"id":"CVE-2026-73208","aliases":["ALPINE-CVE-2026-73208","ALSA-2026:76763","ALSA-2026:79371","ALSA-2026:80825","AZL-98295","CLSA-2026-1792570553","DEBIAN-CVE-2026-73208","EUVD-2026-67680","GHSA-856w-5q8f-fq73","MGASA-2026-0385","RHSA-2026:76763","RHSA-2026:79371","RHSA-2026:80825","RLSA-2026:76763","RLSA-2026:79371","RLSA-2026:80825","SUSE-SU-2026:23595-1","SUSE-SU-2026:4139-1","UBUNTU-CVE-2026-73208","openSUSE-SU-2026:11629-1","openSUSE-SU-2026:21720-1"],"status":"published","title":"An attacker that holds a token intended for a different purpose can authenticate, because when an...","description":"An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim does not describe what a token is allowed to do. A token that grants no relevant permissions can be accepted because its intended recipient value happens to match a configured scope name, granting access that should have been denied. It also hides an identity provider misconfiguration where scopes are not being issued at all. Ensure the identity provider issues a scope claim for all tokens used with Dovecot, and that configured scope names do not match audience values. Update to non-vulnerable version. No publicly available exploits are known.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00312,"percentile":0.24258,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2026-08-28T00:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"dovecot","fixed_in":["2.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"dovecot","fixed_in":["2.4.5-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"dovecot","fixed_in":["1:2.3.19.1+dfsg1-2.1+deb12u7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dovecot","fixed_in":["1:2.4.1+dfsg1-6+deb13u7"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dovecot","fixed_in":["1:2.4.5+dfsg1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Azure Linux:3","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.20-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-8.el9_2.tuxcare.els8"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-8.el9_2.tuxcare.els8"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-8.el9_2.tuxcare.els8"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-8.el9_2.tuxcare.els8"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-8.el9_2.tuxcare.els8"}]}],"bundled":7},{"source":"osv","ecosystem":"Debian:12","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.19.1+dfsg1-2.1+deb12u7"}]}],"versions":["1:2.3.19.1+dfsg1-2.1","1:2.3.19.1+dfsg1-2.1+deb12u1","1:2.3.19.1+dfsg1-2.1+deb12u2","1:2.3.19.1+dfsg1-2.1+deb12u3","1:2.3.19.1+dfsg1-2.1+deb12u4","1:2.3.19.1+dfsg1-2.1+deb12u5","1:2.3.19.1+dfsg1-2.1+deb12u6"]},{"source":"osv","ecosystem":"Debian:13","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.1+dfsg1-6+deb13u7"}]}],"versions":["1:2.4.1+dfsg1-6","1:2.4.1+dfsg1-6+deb13u1","1:2.4.1+dfsg1-6+deb13u2","1:2.4.1+dfsg1-6+deb13u3","1:2.4.1+dfsg1-6+deb13u4","1:2.4.1+dfsg1-6+deb13u5","1:2.4.1+dfsg1-6+deb13u6"]},{"source":"osv","ecosystem":"Debian:14","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.5+dfsg1-1"}]}],"versions":["1:2.4.1+dfsg1-6","1:2.4.1+dfsg1-7","1:2.4.1+dfsg1-8","1:2.4.1+dfsg1-9","1:2.4.2+dfsg1-1","1:2.4.2+dfsg1-2","1:2.4.2+dfsg1-3","1:2.4.2+dfsg1-4","1:2.4.3+dfsg1-1","1:2.4.3+dfsg1-2","1:2.4.4+dfsg1-1","1:2.4.4+dfsg1-2"]},{"source":"osv","ecosystem":"Mageia:10","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-2.mga10"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pigeonhole-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-pigeonhole-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-pigeonhole-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-pigeonhole-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-pigeonhole-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-16.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:10","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.21-19.el10_2.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-18.el9_8.8"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-160000.2.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-160000.2.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.21.1-150200.76.1"}]}],"bundled":34},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.1.7-7ubuntu3","1:2.2.9-1ubuntu1","1:2.2.9-1ubuntu2","1:2.2.9-1ubuntu2.1","1:2.2.9-1ubuntu2.3","1:2.2.9-1ubuntu2.4","1:2.2.9-1ubuntu2.5","1:2.2.9-1ubuntu2.6","1:2.2.9-1ubuntu2.6+esm1","1:2.2.9-1ubuntu2.6+esm2","1:2.2.9-1ubuntu2.6+esm3","1:2.2.9-1ubuntu2.6+esm4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.2.18-2ubuntu2","1:2.2.22-1ubuntu1","1:2.2.22-1ubuntu2","1:2.2.22-1ubuntu2.1","1:2.2.22-1ubuntu2.2","1:2.2.22-1ubuntu2.3","1:2.2.22-1ubuntu2.4","1:2.2.22-1ubuntu2.6","1:2.2.22-1ubuntu2.7","1:2.2.22-1ubuntu2.8","1:2.2.22-1ubuntu2.9","1:2.2.22-1ubuntu2.10","1:2.2.22-1ubuntu2.11","1:2.2.22-1ubuntu2.12","1:2.2.22-1ubuntu2.13","1:2.2.22-1ubuntu2.14"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.2.27-3ubuntu1","1:2.2.33.2-1ubuntu1","1:2.2.33.2-1ubuntu2","1:2.2.33.2-1ubuntu3","1:2.2.33.2-1ubuntu4","1:2.2.33.2-1ubuntu4.1","1:2.2.33.2-1ubuntu4.2","1:2.2.33.2-1ubuntu4.3","1:2.2.33.2-1ubuntu4.4","1:2.2.33.2-1ubuntu4.5","1:2.2.33.2-1ubuntu4.6","1:2.2.33.2-1ubuntu4.7","1:2.2.33.2-1ubuntu4.8"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3.4.1-5ubuntu3","1:2.3.7.2-1ubuntu1","1:2.3.7.2-1ubuntu2","1:2.3.7.2-1ubuntu3","1:2.3.7.2-1ubuntu3.1","1:2.3.7.2-1ubuntu3.2","1:2.3.7.2-1ubuntu3.3","1:2.3.7.2-1ubuntu3.4","1:2.3.7.2-1ubuntu3.5","1:2.3.7.2-1ubuntu3.6","1:2.3.7.2-1ubuntu3.7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3.13+dfsg1-1ubuntu3","1:2.3.16+dfsg1-3ubuntu1","1:2.3.16+dfsg1-3ubuntu2","1:2.3.16+dfsg1-3ubuntu2.1","1:2.3.16+dfsg1-3ubuntu2.2","1:2.3.16+dfsg1-3ubuntu2.4","1:2.3.16+dfsg1-3ubuntu2.6","1:2.3.16+dfsg1-3ubuntu2.7","1:2.3.16+dfsg1-3ubuntu2.8","1:2.3.16+dfsg1-3ubuntu2.9"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3.20+dfsg1-1ubuntu3","1:2.3.21+dfsg1-2ubuntu1","1:2.3.21+dfsg1-2ubuntu2","1:2.3.21+dfsg1-2ubuntu4","1:2.3.21+dfsg1-2ubuntu5","1:2.3.21+dfsg1-2ubuntu6","1:2.3.21+dfsg1-2ubuntu6.1","1:2.3.21+dfsg1-2ubuntu6.2","1:2.3.21+dfsg1-2ubuntu6.3","1:2.3.21+dfsg1-2ubuntu6.4","1:2.3.21+dfsg1-2ubuntu6.5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.4.1+dfsg1-5ubuntu4","1:2.4.1+dfsg1-5ubuntu5","1:2.4.2+dfsg1-3ubuntu1","1:2.4.2+dfsg1-3ubuntu2","1:2.4.2+dfsg1-3ubuntu2.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-1.1"}]}],"bundled":22},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-160000.2.1"}]}],"bundled":24}],"products":[{"vendor":"open-xchange gmbh","product":"ox dovecot ce"},{"vendor":"open-xchange gmbh","product":"ox dovecot pro"}],"references":[{"url":"https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json","tags":["vendor-advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73208","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-856w-5q8f-fq73"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-73208","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76763","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27852","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33263","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33605","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40018","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40019","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42007","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42391","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73208","tags":["report"]},{"url":"https://bugzilla.redhat.com/2525545","tags":["report"]},{"url":"https://bugzilla.redhat.com/2525547","tags":["report"]},{"url":"https://bugzilla.redhat.com/2525557","tags":["report"]},{"url":"https://bugzilla.redhat.com/2525559","tags":["report"]},{"url":"https://bugzilla.redhat.com/2525567","tags":["report"]},{"url":"https://bugzilla.redhat.com/2525576","tags":["report"]},{"url":"https://bugzilla.redhat.com/2525583","tags":["report"]},{"url":"https://bugzilla.redhat.com/2525584","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-76763.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:79371","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-79371.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:80825","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-80825.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792570553.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27852","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33263","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33605","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40018","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42007","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42391","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-73208","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0385.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36219","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/28/1","tags":["web"]},{"url":"https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525545","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525547","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525557","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525559","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525567","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525576","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525583","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525584","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-176273","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76763.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27852","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33263","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33605","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40018","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40019","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40019","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42007","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42391","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73208","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_79371.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80825.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:76763","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:79371","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:80825","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623595-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276794","tags":["report"]},{"url":"https://bugzilla.suse.com/1276795","tags":["report"]},{"url":"https://bugzilla.suse.com/1276799","tags":["report"]},{"url":"https://bugzilla.suse.com/1276800","tags":["report"]},{"url":"https://bugzilla.suse.com/1276802","tags":["report"]},{"url":"https://bugzilla.suse.com/1276804","tags":["report"]},{"url":"https://bugzilla.suse.com/1276807","tags":["report"]},{"url":"https://bugzilla.suse.com/1276809","tags":["report"]},{"url":"https://bugzilla.suse.com/1276810","tags":["report"]},{"url":"https://bugzilla.suse.com/1276812","tags":["report"]},{"url":"https://bugzilla.suse.com/1276813","tags":["report"]},{"url":"https://bugzilla.suse.com/1276815","tags":["report"]},{"url":"https://bugzilla.suse.com/1276817","tags":["report"]},{"url":"https://bugzilla.suse.com/1276819","tags":["report"]},{"url":"https://bugzilla.suse.com/1276820","tags":["report"]},{"url":"https://bugzilla.suse.com/1276824","tags":["report"]},{"url":"https://bugzilla.suse.com/1276826","tags":["report"]},{"url":"https://bugzilla.suse.com/1276827","tags":["report"]},{"url":"https://bugzilla.suse.com/1276828","tags":["report"]},{"url":"https://bugzilla.suse.com/1276829","tags":["report"]},{"url":"https://bugzilla.suse.com/1276830","tags":["report"]},{"url":"https://bugzilla.suse.com/1276833","tags":["report"]},{"url":"https://bugzilla.suse.com/1276835","tags":["report"]},{"url":"https://bugzilla.suse.com/1276837","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73209","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264139-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1229183","tags":["report"]},{"url":"https://bugzilla.suse.com/1229184","tags":["report"]},{"url":"https://bugzilla.suse.com/1260894","tags":["report"]},{"url":"https://bugzilla.suse.com/1260895","tags":["report"]},{"url":"https://bugzilla.suse.com/1260897","tags":["report"]},{"url":"https://bugzilla.suse.com/1260898","tags":["report"]},{"url":"https://bugzilla.suse.com/1260899","tags":["report"]},{"url":"https://bugzilla.suse.com/1260900","tags":["report"]},{"url":"https://bugzilla.suse.com/1260901","tags":["report"]},{"url":"https://bugzilla.suse.com/1260902","tags":["report"]},{"url":"https://bugzilla.suse.com/1265147","tags":["report"]},{"url":"https://bugzilla.suse.com/1265148","tags":["report"]},{"url":"https://bugzilla.suse.com/1265149","tags":["report"]},{"url":"https://bugzilla.suse.com/1265150","tags":["report"]},{"url":"https://bugzilla.suse.com/1276811","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42006","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-73208","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4200","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-73208","description":"An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim does not describe what a token is allowed to do. A token that grants no relevant permissions can be accepted because its intended recipient value happens to match a configured scope name, granting access that should have been denied. It also hides an identity provider misconfiguration where scopes are not being issued at all. Ensure the identity provider issues a scope claim for all tokens used with Dovecot, and that configured scope names do not match audience values. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T10:12:32.679Z","modified":"2026-08-28T15:53:21.257Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T13:43:33.766176Z"}],"euvd":[{"id":"EUVD-2026-67680","description":"An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim does not describe what a token is allowed to do. A token that grants no relevant permissions can be accepted because its intended recipient value happens to match a configured scope name, granting access that should have been denied. It also hides an identity provider misconfiguration where scopes are not being issued at all. Ensure the identity provider issues a scope claim for all tokens used with Dovecot, and that configured scope names do not match audience values. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T10:12:32Z","modified":"2026-08-28T15:53:21Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:23.104802Z"}],"ghsa":[{"id":"GHSA-856w-5q8f-fq73","title":"An attacker that holds a token intended for a different purpose can authenticate, because when an...","description":"An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim does not describe what a token is allowed to do. A token that grants no relevant permissions can be accepted because its intended recipient value happens to match a configured scope name, granting access that should have been denied. It also hides an identity provider misconfiguration where scopes are not being issued at all. Ensure the identity provider issues a scope claim for all tokens used with Dovecot, and that configured scope names do not match audience values. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T12:30:26Z","modified":"2026-08-28T12:30:35Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:11:06.970333Z"}],"nvd":[{"id":"CVE-2026-73208","description":"An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim does not describe what a token is allowed to do. A token that grants no relevant permissions can be accepted because its intended recipient value happens to match a configured scope name, granting access that should have been denied. It also hides an identity provider misconfiguration where scopes are not being issued at all. Ensure the identity provider issues a scope claim for all tokens used with Dovecot, and that configured scope names do not match audience values. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T12:16:31.127Z","modified":"2026-09-03T18:13:44.643Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:12:42.366888Z"}],"osv":[{"id":"ALPINE-CVE-2026-73208","description":"An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim does not describe what a token is allowed to do. A token that grants no relevant permissions can be accepted because its intended recipient value happens to match a configured scope name, granting access that should have been denied. It also hides an identity provider misconfiguration where scopes are not being issued at all. Ensure the identity provider issues a scope claim for all tokens used with Dovecot, and that configured scope names do not match audience values. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T12:16:31.127Z","modified":"2026-10-01T02:17:49.402523852Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"DEBIAN-CVE-2026-73208","description":"An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim does not describe what a token is allowed to do. A token that grants no relevant permissions can be accepted because its intended recipient value happens to match a configured scope name, granting access that should have been denied. It also hides an identity provider misconfiguration where scopes are not being issued at all. Ensure the identity provider issues a scope claim for all tokens used with Dovecot, and that configured scope names do not match audience values. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T12:16:31.127Z","modified":"2026-10-31T16:01:17.274585154Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:46:02.499355Z"},{"id":"RHSA-2026:76763","title":"Red Hat Security Advisory: dovecot security, bug fix, and enhancement update","status":"published","published":"2026-10-07T10:20:12Z","modified":"2026-10-14T10:30:50Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:79371","title":"Red Hat Security Advisory: dovecot security update","status":"published","published":"2026-10-10T10:22:51Z","modified":"2026-10-14T10:31:32Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:80825","title":"Red Hat Security Advisory: dovecot security update","status":"published","published":"2026-10-14T10:32:18Z","modified":"2026-10-14T10:48:13.36336687Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:76763","title":"Important: dovecot security, bug fix, and enhancement update","description":"Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. \n\nSecurity Fix(es):\n\n* dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)\n\n* dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)\n\n* dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)\n\n* dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)\n\n* dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)\n\n* dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)\n\n* dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)\n\n* dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)\n\nBug Fix(es) and Enhancement(s):\n\n* Dovecot crashes when accessing mailbox with: \"Panic: file mail-user.c: line 229 (mail_user_deinit): assertion failed: ((*user)-\u003erefcount == 1)\" (JIRA:Rocky Linux-176273)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-07T06:01:37.070463Z","modified":"2026-10-07T06:30:02.504205974Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:79371","title":"Important: dovecot security update","description":"Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. \n\nSecurity Fix(es):\n\n* dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)\n\n* dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)\n\n* dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)\n\n* dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)\n\n* dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)\n\n* dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)\n\n* dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)\n\n* dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-10T12:08:29.652489Z","modified":"2026-10-10T12:30:02.802466374Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:80825","title":"Important: dovecot security update","description":"Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. \n\nSecurity Fix(es):\n\n* dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)\n\n* dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)\n\n* dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)\n\n* dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)\n\n* dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)\n\n* dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)\n\n* dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)\n\n* dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-14T06:30:05.473043Z","modified":"2026-10-14T07:00:03.752889242Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-73208","description":"An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim does not describe what a token is allowed to do. A token that grants no relevant permissions can be accepted because its intended recipient value happens to match a configured scope name, granting access that should have been denied. It also hides an identity provider misconfiguration where scopes are not being issued at all. Ensure the identity provider issues a scope claim for all tokens used with Dovecot, and that configured scope names do not match audience values. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T00:00:00Z","modified":"2026-09-02T19:36:41.759302346Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:57:08.628462Z"},{"id":"ALSA-2026:76763","title":"Important: dovecot security, bug fix, and enhancement update","description":"Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.   \n\nSecurity Fix(es):  \n\n  * dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)\n  * dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)\n  * dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)\n  * dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)\n  * dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)\n  * dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)\n  * dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)\n  * dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Dovecot crashes when accessing mailbox with: \"Panic: file mail-user.c: line 229 (mail_user_deinit): assertion failed: ((*user)-\u003erefcount == 1)\" (JIRA:AlmaLinux-176273)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-06T00:00:00Z","modified":"2026-10-29T11:02:29.698212973Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:79371","title":"Important: dovecot security update","description":"Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.   \n\nSecurity Fix(es):  \n\n  * dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)\n  * dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)\n  * dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)\n  * dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)\n  * dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)\n  * dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)\n  * dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)\n  * dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-08T00:00:00Z","modified":"2026-10-29T11:30:22.696711302Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:80825","title":"Important: dovecot security update","description":"Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.   \n\nSecurity Fix(es):  \n\n  * dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)\n  * dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)\n  * dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)\n  * dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)\n  * dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)\n  * dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)\n  * dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)\n  * dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-12T00:00:00Z","modified":"2026-10-29T11:32:38.156304729Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-98295","title":"CVE-2026-73208 affecting package dovecot 2.3.20-1","description":"An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim does not describe what a token is allowed to do. A token that grants no relevant permissions can be accepted because its intended recipient value happens to match a configured scope name, granting access that should have been denied. It also hides an identity provider misconfiguration where scopes are not being issued at all. Ensure the identity provider issues a scope claim for all tokens used with Dovecot, and that configured scope names do not match audience values. Update to non-vulnerable version. No publicly available exploits are known.","status":"published","published":"2026-08-28T12:16:31Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"CLSA-2026-1792570553","title":"dovecot: Fix of 7 CVEs","description":"- CVE-2026-27852: bound the transient RFC 2231 parameter list and the MIME\n  parameter budget so a single oversized Content-Type header cannot exhaust\n  imap memory\n- CVE-2026-33263: track SMTP server connection closure so submission-login\n  does not keep using a closed connection\n- CVE-2026-33605: fix ManageSieve parser handling of a single-byte quoted\n  string read in managesieve-login\n- CVE-2026-40018: connect before expanding the passdb-sql password query and\n  refuse to escape in the MySQL driver without a connection instead of\n  escaping with the default charset\n- CVE-2026-42007: fix Sieve editheader edit-mail handling of deleted and\n  NUL-containing header values\n- CVE-2026-42391: account external key/value pairs in the IMAP login ID\n  command so a client cannot send an unbounded number of them\n- CVE-2026-73208: validate the OAuth2 token audience and stop falling back to\n  the aud claim when audience is configured","status":"published","published":"2026-10-21T08:16:09Z","modified":"2026-10-26T09:31:00.261538056Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"MGASA-2026-0385","title":"Updated dovecot package fixes security vulnerabilities","description":"submission-login: Panic when mail_max_userip_connections is reached:\nPanic: epoll_ctl(del, 8) failed: Bad file descriptor. (CVE-2026-33263)\nDovecot IMAP LIST match_sub() Exponential Backtracking — CPU Denial of\nService. (CVE-2026-33607)\nDoS by sending mail with bad header. (CVE-2026-27852)\ndsync: Mail content can cause dsync protocol injection. (CVE-2026-33606)\nSMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return.\n(CVE-2026-33604)\nIMAP THREAD REFERENCES O(N²) CPU DoS via Crafted References Header\n(index-thread-links.c). (CVE-2026-40014)\npigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve\nCHECKSCRIPT/PUTSCRIPT. (CVE-2026-40013)\nmanagesieve-login: Pre-auth crash. (CVE-2026-33605)\nMySQL multi-byte escaping wrong. (CVE-2026-40018)\nv2.4.3 regression: managesieve-login pre-auth infinite loop.\n(CVE-2026-40019)\nimap-hibernate can be crashed. (CVE-2026-40015)\nIMAP THREAD O(M³) CPU DoS via CRC32 Hash Collision in strmap\n(mail-index-strmap.c / hash2.c). (CVE-2026-40017)\nIMAP Compression Can Reveal Whether a Small Synced Email Body Matches\nSender-Chosen Text. (CVE-2026-40203)\nSieve editheader RCE. (CVE-2026-42007)\nacl: lda_mailbox_autocreate can bypass acl restrictions.\n(CVE-2026-40204)\nOAuth2 passdb scope enforcement bypass via OR semantics in remote\nvalidation path. (CVE-2026-40205)\nXCLIENT FORWARD= bare token not namespaced, allows nopassword injection\nvia trusted proxy. (CVE-2026-42008)\nSingle NUL-Byte XCLIENT FORWARD Payload Crashes. (CVE-2026-42395)\ndoveadm_password or api key length can still be leaked with timing\ncomparisons. (CVE-2026-42393)\nSieve resource usage tracking lost when active script changes.\n(CVE-2026-52681)\nimap-urlauth leaks memory into user-visible error messages.\n(CVE-2026-42392)\nauth: db-oauth2: aud claim used as fallback for missing scope claim.\n(CVE-2026-73208)\nimap-login crash: Self-recursion on zero-output decompress chunks.\n(CVE-2026-73209)\nimap: Pre-login memory/CPU growth with ID command. (CVE-2026-42391)\nIMAP: COMPRESS ZSTD can cause excessive memory usage. (CVE-2026-52687)\n","status":"published","published":"2026-09-09T04:15:20Z","modified":"2026-09-09T04:42:22.817277874Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11629-1","title":"dovecot24-2.4.5-1.1 on GA media","description":"These are all security issues fixed in the dovecot24-2.4.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-28T00:00:00Z","modified":"2026-08-29T09:15:04.342434035Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21720-1","title":"Security update for dovecot24","description":"This update for dovecot24 fixes the following issues:\n\nUpdate to 2.4.5.\n\n- CVE-2026-33263: `submission-login`: panic when `mail_max_userip_connections` is reached (bsc#1276794).\n- CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799).\n- CVE-2026-33604: SMTP smuggling via missing dot-stuffing after bare carriage return (bsc#1276802).\n- CVE-2026-33605: `managesieve-login`: pre-auth crash (bsc#1276809).\n- CVE-2026-33606: `dsync`: mail content can cause `dsync` protocol injection (bsc#1276800).\n- CVE-2026-33607: IMAP `LIST` `match_sub()` exponential backtracking leading to CPU denial of service (bsc#1276795).\n- CVE-2026-40013: stack buffer underflow in `pigeonhole` `ManageSieve` `CHECKSCRIPT/PUTSCRIPT` (bsc#1276807).\n- CVE-2026-40014: CPU DoS via crafted references header (bsc#1276804).\n- CVE-2026-40015: `imap-hibernate` can be crashed (bsc#1276812).\n- CVE-2026-40017: CPU DoS via CRC32 hash collision in `strmap` (bsc#1276813).\n- CVE-2026-40018: MySQL multi-byte escaping performed incorrectly (bsc#1276810).\n- CVE-2026-40203: IMAP compression can reveal whether a small synced email body matches sender-chosen text\n  (bsc#1276815).\n- CVE-2026-40204: `lda_mailbox_autocreate` can bypass ACL restrictions (bsc#1276819).\n- CVE-2026-40205: OAuth2 `passdb` scope enforcement bypass via OR semantics in remote validation path (bsc#1276820).\n- CVE-2026-42007: `sieve` `editheader` RCE (bsc#1276817).\n- CVE-2026-42008: `XCLIENT FORWARD= bare` token not namespaced (bsc#1276824).\n- CVE-2026-42391: `imap`: pre-login memory/CPU growth with `ID` command (bsc#1276835).\n- CVE-2026-42392: `imap-urlauth` leaks memory into user-visible error messages (bsc#1276829).\n- CVE-2026-42393: `doveadm_password` or api key length can be leaked with timing comparisons (bsc#1276827).\n- CVE-2026-52687: `imap`: `COMPRESS ZSTD` can cause excessive memory usage (bsc#1276837).\n- CVE-2026-42395: single NUL-byte `XCLIENT FORWARD` payload crashes (bsc#1276826).\n- CVE-2026-52681: `sieve` resource usage tracking lost when active script changes (bsc#1276828).\n- CVE-2026-73208: `auth`: `db-oauth2`: `aud` claim used as fallback for missing scope claim (bsc#1276830).\n- CVE-2026-73209: `imap-login` crash due to self-recursion on zero-output decompress chunks (bsc#1276833).\n","status":"published","published":"2026-09-01T14:18:02Z","modified":"2026-09-02T18:00:03.64873556Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23595-1","title":"Security update for dovecot24","description":"This update for dovecot24 fixes the following issues:\n\nUpdate to 2.4.5.\n\n- CVE-2026-33263: `submission-login`: panic when `mail_max_userip_connections` is reached (bsc#1276794).\n- CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799).\n- CVE-2026-33604: SMTP smuggling via missing dot-stuffing after bare carriage return (bsc#1276802).\n- CVE-2026-33605: `managesieve-login`: pre-auth crash (bsc#1276809).\n- CVE-2026-33606: `dsync`: mail content can cause `dsync` protocol injection (bsc#1276800).\n- CVE-2026-33607: IMAP `LIST` `match_sub()` exponential backtracking leading to CPU denial of service (bsc#1276795).\n- CVE-2026-40013: stack buffer underflow in `pigeonhole` `ManageSieve` `CHECKSCRIPT/PUTSCRIPT` (bsc#1276807).\n- CVE-2026-40014: CPU DoS via crafted references header (bsc#1276804).\n- CVE-2026-40015: `imap-hibernate` can be crashed (bsc#1276812).\n- CVE-2026-40017: CPU DoS via CRC32 hash collision in `strmap` (bsc#1276813).\n- CVE-2026-40018: MySQL multi-byte escaping performed incorrectly (bsc#1276810).\n- CVE-2026-40203: IMAP compression can reveal whether a small synced email body matches sender-chosen text\n  (bsc#1276815).\n- CVE-2026-40204: `lda_mailbox_autocreate` can bypass ACL restrictions (bsc#1276819).\n- CVE-2026-40205: OAuth2 `passdb` scope enforcement bypass via OR semantics in remote validation path (bsc#1276820).\n- CVE-2026-42007: `sieve` `editheader` RCE (bsc#1276817).\n- CVE-2026-42008: `XCLIENT FORWARD= bare` token not namespaced (bsc#1276824).\n- CVE-2026-42391: `imap`: pre-login memory/CPU growth with `ID` command (bsc#1276835).\n- CVE-2026-42392: `imap-urlauth` leaks memory into user-visible error messages (bsc#1276829).\n- CVE-2026-42393: `doveadm_password` or api key length can be leaked with timing comparisons (bsc#1276827).\n- CVE-2026-52687: `imap`: `COMPRESS ZSTD` can cause excessive memory usage (bsc#1276837).\n- CVE-2026-42395: single NUL-byte `XCLIENT FORWARD` payload crashes (bsc#1276826).\n- CVE-2026-52681: `sieve` resource usage tracking lost when active script changes (bsc#1276828).\n- CVE-2026-73208: `auth`: `db-oauth2`: `aud` claim used as fallback for missing scope claim (bsc#1276830).\n- CVE-2026-73209: `imap-login` crash due to self-recursion on zero-output decompress chunks (bsc#1276833).\n","status":"published","published":"2026-09-01T14:12:16Z","modified":"2026-09-29T18:23:18.714105294Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:4139-1","title":"Security update for dovecot23","description":"This update for dovecot23 fixes the following issues:\n\n- CVE-2024-23184: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU\n  intensive (bsc#1229184).\n- CVE-2024-23185: large headers can cause resource exhaustion when parsing message (bsc#1229183).\n- CVE-2025-59028: Invalid base64 authentication can cause DoS for other logins (bsc#1260894).\n- CVE-2025-59031: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing\n  (bsc#1260895).\n- CVE-2025-59032: pigeonhole: ManageSieve panic occurs with sieve-connect as a client (bsc#1260902).\n- CVE-2026-27852: DoS by sending mail with bad header (bsc#1276799).\n- CVE-2026-27855: OTP driver vulnerable to replay attack (bsc#1260900).\n- CVE-2026-27856: Doveadm credentials were not checked using timing-safe checking function (bsc#1260899).\n- CVE-2026-27857: sending excessive parenthesis causes imap-login to use excessive memory (bsc#1260898).\n- CVE-2026-27858: pigeonhole: managesieve-login can allocate large amount of memory during authentication (bsc#1260901).\n- CVE-2026-27859: excessive RFC 2231 MIME parameters in email would can excessive CPU usage (bsc#1260897).\n- CVE-2026-33263: submission-login: Panic when mail_max_userip_connections is reached (bsc#1276794).\n- CVE-2026-33603: login: base64 input can contain tabs that bypass IPC protection (bsc#1265147).\n- CVE-2026-33604: SMTP Smuggling via Missing Dot-Stuffing (bsc#1276802).\n- CVE-2026-33605: managesieve-login: Pre-auth crash (bsc#1276809).\n- CVE-2026-33606: dsync: Mail content can cause dsync protocol injection (bsc#1276800).\n- CVE-2026-33607: IMAP LIST match_sub() Exponential Backtracking -- CPU Denial of Service (bsc#1276795).\n- CVE-2026-40014: CPU DoS via Crafted References Header (bsc#1276804).\n- CVE-2026-40015: imap-hibernate can be crashed (bsc#1276812).\n- CVE-2026-40016: Sieve :contains/:matches O(NxM) substring match bypasses sieve_max_cpu_time limit (bsc#1265148).\n- CVE-2026-40019: managesieve-login pre-auth infinite loop (bsc#1276811).\n- CVE-2026-40020: IMAP folders can be shared-spammed to everyone (bsc#1265149).\n- CVE-2026-40203: IMAP Compression Can Reveal Whether a Small Synced Email Body Matches Sender-Chosen Text\n  (bsc#1276815).\n- CVE-2026-40205: OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path (bsc#1276820).\n- CVE-2026-42006: imap-login: uncontrolled memory usage with excessive bracing over IMAP (bsc#1265150).\n- CVE-2026-42007: editheader RCE (bsc#1276817).\n- CVE-2026-42008: XCLIENT FORWARD= bare token not namespaced (bsc#1276824).\n- CVE-2026-42391: imap: Pre-login memory/CPU growth with ID command (bsc#1276835).\n- CVE-2026-42393: doveadm_password or api key length can still be leaked with timing comparisons (bsc#1276827).\n- CVE-2026-42395: Single NUL-Byte XCLIENT FORWARD Payload Crashes (bsc#1276826).\n- CVE-2026-52681: Sieve resource usage tracking lost when active script changes (bsc#1276828).\n- CVE-2026-52687: IMAP: COMPRESS ZSTD can cause excessive memory usage (bsc#1276837).\n- CVE-2026-73208: auth: db-oauth2: aud claim used as fallback for missing scope claim (bsc#1276830).\n- CVE-2026-73209: imap-login crash: Self-recursion on zero-output decompress chunks (bsc#1276833).\n\nChanges for dovecot23:\n\n- Update to version 2.3.21.1.\n","status":"published","published":"2026-09-14T07:22:32Z","modified":"2026-09-28T18:23:12.561527353Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}