Dovecot vulnerabilities

Products

• Dovecot 69

Newest

• dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +14 more +16 more An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE... CVE-2026-42006 Fix available 4.3 MediumMay 12, 2026
• dovecot, open-xchange gmbh ox dovecot pro +1 more Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl... CVE-2026-40020 Fix available 3.1 LowMay 12, 2026
• dovecot, open-xchange gmbh ox dovecot pro +1 more Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass... CVE-2026-40016 Fix available 5.3 MediumMay 12, 2026
• dovecot, open-xchange gmbh ox dovecot pro +1 more Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS... CVE-2026-33603 Fix available 6.8 MediumMay 12, 2026
• dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +3 more +5 more When safe filter is used with variable expansion, all following pipelines on the same string are... CVE-2026-27851 Fix available 7.4 HighMay 12, 2026
• dovecot, open-xchange gmbh ox dovecot pro +1 more If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP... CVE-2026-27860 Fix available 3.7 LowMarch 27, 2026
• dovecot, open-xchange gmbh ox dovecot pro +1 more A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too... CVE-2026-27859 Fix available 5.3 MediumMarch 27, 2026
• dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +16 more +18 more Attacker can send a specifically crafted message before authentication that causes managesieve to... CVE-2026-27858 Fix available 7.5 HighMarch 27, 2026
• dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +16 more +18 more Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory... CVE-2026-27857 Fix available 4.3 MediumMarch 27, 2026
• dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +4 more +6 more Doveadm credentials are verified using direct comparison which is susceptible to timing oracle... CVE-2026-27856 Fix available 7.4 HighMarch 27, 2026
• dovecot, open-xchange gmbh ox dovecot pro +1 more Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth... CVE-2026-27855 Fix available 6.8 MediumMarch 27, 2026
• dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +4 more +6 more Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin.... CVE-2026-24031 Public exploitFix available 7.7 HighMarch 27, 2026
• dovecot, open-xchange gmbh ox dovecot pro +1 more When dovecot has been configured to use per-domain passwd files, and they are placed one path... CVE-2026-0394 Fix available 5.3 MediumMarch 27, 2026
• dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +16 more +18 more ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be... CVE-2025-59032 Fix available 7.5 HighMarch 27, 2026
• dovecot, open-xchange gmbh ox dovecot pro +1 more Dovecot has provided a script to use for attachment to text conversion. This script unsafely... CVE-2025-59031 Fix available 4.3 MediumMarch 27, 2026
• dovecot, open-xchange gmbh ox dovecot pro +1 more When sending invalid base64 SASL data, login process is disconnected from the auth server,... CVE-2025-59028 Fix available 5.3 MediumMarch 27, 2026
• dovecot, debian linux +1 more An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two... CVE-2022-30550 Fix available 8.8 HighJuly 7, 2022
• dovecot, fedoraproject fedora +1 more Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem... CVE-2021-29157 Fix available 7.5 HighJune 22, 2021
• dovecot, debian linux, fedoraproject fedora +2 more The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp.... CVE-2021-33515 Fix available 4.8 MediumJune 21, 2021
• dovecot, fedoraproject fedora +1 more The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as... CVE-2020-28200 Fix available 4.3 MediumJune 21, 2021
• dovecot, debian linux, fedoraproject fedora +2 more Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an... CVE-2020-25275 Fix available 7.5 HighJanuary 4, 2021
• dovecot, debian linux, fedoraproject fedora +2 more An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker... CVE-2020-24386 Fix available 6.8 MediumJanuary 4, 2021
• dovecot, canonical ubuntu linux, debian linux +1 more +3 more In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service... CVE-2020-12674 Fix available 7.5 HighAugust 12, 2020
• dovecot, canonical ubuntu linux, debian linux +1 more +3 more In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth... CVE-2020-12673 Fix available 7.5 HighAugust 12, 2020
• dovecot, canonical ubuntu linux, debian linux +1 more +3 more In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote... CVE-2020-12100 Fix available 7.5 HighAugust 12, 2020
• dovecot In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission... CVE-2020-10967 Fix available 5.3 MediumMay 18, 2020
• dovecot In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after... CVE-2020-10958 Fix available 5.3 MediumMay 18, 2020
• dovecot In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command... CVE-2020-10957 Fix available 7.5 HighMay 18, 2020
• dovecot, fedoraproject fedora +1 more The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when... CVE-2020-7957 Fix available 3.1 LowFebruary 12, 2020
• dovecot, fedoraproject fedora +1 more lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8... CVE-2020-7046 Fix available EPSS 51.3% 7.5 HighFebruary 12, 2020
• dovecot, fedoraproject fedora +1 more In Dovecot before 2.3.9.2, an attacker can crash a push-notification driver with a crafted email... CVE-2019-19722 Fix available 5.3 MediumDecember 13, 2019
• dovecot, dovecot pigeonhole, debian linux +1 more +3 more In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol... CVE-2019-11500 Fix available EPSS 62.3% 9.8 CriticalAugust 28, 2019
• dovecot, fedoraproject fedora, opensuse leap +2 more In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login component crashes if... CVE-2019-11499 Fix available 7.5 HighApril 30, 2019
• dovecot, fedoraproject fedora, opensuse leap +2 more In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login service crashes when... CVE-2019-11494 Fix available 7.5 HighApril 30, 2019
• dovecot, opensuse leap +1 more The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the... CVE-2019-10691 Fix available 7.5 HighApril 18, 2019
• dovecot, canonical ubuntu linux, debian linux +1 more +3 more In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow... CVE-2019-7524 Fix available 8.8 HighMarch 28, 2019
• dovecot, canonical ubuntu linux, opensuse leap +2 more It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client... CVE-2019-3814 Fix available 7.7 HighFebruary 5, 2019
• dovecot, canonical ubuntu linux, debian linux +2 more A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random... CVE-2017-15130 Fix available 5.9 MediumFebruary 28, 2018
• dovecot, debian linux, ubuntu +2 more A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out... CVE-2017-14461 Fix available EPSS 16.7% 5.9 MediumFebruary 28, 2018
• dovecot, canonical ubuntu linux, debian linux +2 more A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results... CVE-2017-15132 Fix available 7.5 HighJanuary 25, 2018
• dovecot, fedoraproject fedora +1 more The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote... CVE-2015-3420 Fix available 5.9 MediumSeptember 19, 2017
• [unknown] dovecot, debian linux +1 more Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb... CVE-2017-2669 Fix available 3.7 LowApril 10, 2017
• dovecot The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote... CVE-2016-8652 Fix available EPSS 48.2% 5.9 MediumFebruary 16, 2017
• dovecot, fedora dovecot22, opensuse leap +2 more +4 more A postinstall script in the dovecot rpm allows local users to read the contents of newly created... CVE-2016-4983 Fix available 3.3 LowNovember 25, 2016
• dovecot The IMAP functionality in Dovecot before 2.2.2 allows remote attackers to cause a denial of... CVE-2013-2111 5.0 MediumMay 27, 2014
• dovecot Dovecot 1.1 before 2.2.13 and dovecot-ee before 2.1.7.7 and 2.2.x before 2.2.12.12 does not... CVE-2014-3430 Fix available 5.0 MediumMay 13, 2014
• dovecot checkpassword-reply in Dovecot before 2.2.7 performs setuid operations to a user who is... CVE-2013-6171 Fix available 5.8 MediumDecember 9, 2013
• dovecot Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the... CVE-2011-4318 Fix available 5.8 MediumMarch 7, 2013
• dovecot script-login in Dovecot 2.0.x before 2.0.13 does not follow the chroot configuration setting,... CVE-2011-2167 Fix available 6.5 MediumMay 24, 2011
• dovecot script-login in Dovecot 2.0.x before 2.0.13 does not follow the user and group configuration... CVE-2011-2166 Fix available 6.5 MediumMay 24, 2011
• Show olderLoading…