I was experimenting with using Vivaldi Mail, and dovecot-imapd started
crashing repeatedly when Vivaldi was trying to sync and index my (huge)
mailbox.

Messages logged by Dovecot:

2026-08-14 10:26:43 imap(ian)<466672><Dy4ka/5Y9r1SRXa8>: Panic: file istream-header-filter.c: line 665 (i_stream_header_filter_snapshot_free): assertion failed: (snapshot->mstream->snapshot_pending)
2026-08-14 10:26:43 imap(ian)<466672><Dy4ka/5Y9r1SRXa8>: Error: Raw backtrace: #1 [unw_get_proc_name() failed: -10] -> #2 [unw_get_proc_name() failed: -10] -> #3 i_panic[0x7fe47ca655e6] -> #4 [unw_get_proc_name() failed: -10] -> #5 i_stream_snapshot_free[0x7fe47cb45c00] -> #6 i_stream_unref[0x7fe47cb45c70] -> #7 [unw_get_proc_name() failed: -10] -> #8 [unw_get_proc_name() failed: -10] -> #9 index_mail_get_special[0x7fe47cd494c0] -> #10 mail_get_special[0x7fe47ccc2700] -> #11 [unw_get_proc_name() failed: -10] -> #12 [unw_get_proc_name() failed: -10] -> #13 imap_fetch_more[0x561b58c5cf80] -> #14 cmd_fetch[0x561b58c50e40] -> #15 command_exec[0x561b58c5a080] -> #16 [unw_get_proc_name() failed: -10] -> #17 [unw_get_proc_name() failed: -10] -> #18 [unw_get_proc_name() failed: -10] -> #19 client_handle_input[0x561b58c60990] -> #20 client_input[0x561b58c60ed0] -> #21 io_loop_call_io[0x7fe47cb51750] -> #22 io_loop_handler_run_internal[0x7fe47cb534f0] -> #23 io_loop_handler_run[0x7fe47cb53680] -> #24 io_loop_run[0x7fe47cb53860] -> #25 master_service_run[0x7fe47caa6330] -> #26 main[0x561b58c4b880] -> #27 [unw_get_proc_name() failed: -10] -> #28 __libc_start_main[0x7fe47c835ce0] -> #29 _start[0x561b58c4bf30]

A friend kindly noted that upstream commit
https://github.com/dovecot/core/commit/3ff6022baa757583faf579251fc40 may
fix this problem.  I applied it to 2.4.1+dfsg1-6+deb13u6 and this did
indeed fix the problem.

Control: tags -1 + upstream fixed-upstream patch
Control: found -1 1:2.4.1+dfsg1-6
Control: fixed -1 1:2.4.2+dfsg1-1

Thank you; I've confirmed that the upstream patch applies cleanly, and
this is something we should be able to include in an upcoming point
release.

noah

We believe that the bug you reported is fixed in the latest version of
dovecot, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1144639@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Noah Meyerhans <noahm@debian.org> (supplier of updated dovecot package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 16 Sep 2026 15:06:35 -0400
Source: dovecot
Architecture: source
Version: 1:2.4.1+dfsg1-6+deb13u7
Distribution: trixie-security
Urgency: medium
Maintainer: Dovecot Maintainers <dovecot@packages.debian.org>
Changed-By: Noah Meyerhans <noahm@debian.org>
Closes: 1144639 1146018
Changes:
 dovecot (1:2.4.1+dfsg1-6+deb13u7) trixie-security; urgency=medium
 .
   * Import upstream fixes for multiple security issues. (Closes: #1146018)
     - CVE-2026-27852: DoS by sending mail with bad header
     - CVE-2026-33263: submission-login: Panic when
       mail_max_userip_connections is reached: Panic: epoll_ctl(del, 8)
       failed: Bad file descriptor
     - CVE-2026-33604: SMTP Smuggling via Missing Dot-Stuffing After Bare
       Carriage Return
     - CVE-2026-33605: managesieve-login: Pre-auth crash
     - CVE-2026-33607: Dovecot IMAP LIST match_sub() Exponential
       Backtracking — CPU Denial of Service
     - CVE-2026-40013: pigeonhole: Stack Buffer Underflow in Pigeonhole
       ManageSieve CHECKSCRIPT/PUTSCRIPT
     - CVE-2026-40014: IMAP THREAD REFERENCES O(N²) CPU DoS via Crafted
       References Header (index-thread-links.c)
     - CVE-2026-40015: imap-hibernate can be crashed
     - CVE-2026-40017: IMAP THREAD O(M³) CPU DoS via CRC32 Hash Collision
       in strmap (mail-index-strmap.c / hash2.c)
     - CVE-2026-40018: MySQL multi-byte escaping wrong
     - CVE-2026-40204: acl: lda_mailbox_autocreate can bypass acl
       restrictions
     - CVE-2026-42007: Sieve editheader RCE
     - CVE-2026-42391: imap: Pre-login memory/CPU growth with ID command
     - CVE-2026-42394: sieve: symlink traversal flaw could result in
       arbitrary file disclosure
     - CVE-2026-52681: Sieve resource usage tracking lost when active
       script changes
     - CVE-2026-52687: IMAP: COMPRESS ZSTD can cause excessive memory usage
     - CVE-2026-73209: imap-login crash: Self-recursion on zero-output
       decompress chunks
     - CVE-2026-33606: dsync: Mail content can cause dsync protocol
       injection
     - CVE-2026-40203: IMAP Compression Can Reveal Whether a Small Synced
       Email Body Matches Sender-Chosen Text
     - CVE-2026-42008: XCLIENT FORWARD= bare token not namespaced, allows
       nopassword injection via trusted proxy
     - CVE-2026-42392: imap-urlauth leaks memory into user-visible error
       messages
     - CVE-2026-42393: doveadm_password or api key length can still be
       leaked with timing comparisons
     - CVE-2026-42395: Single NUL-Byte XCLIENT FORWARD Payload Crashes
     - CVE-2026-40205: OAuth2 passdb scope enforcement bypass via OR
       semantics in remote validation path
     - CVE-2026-73208: auth: db-oauth2: aud claim used as fallback for
       missing scope claim
   * lib-mail: istream-header-filter - Fix potential assert-crash
     (Closes: #1144639)
   * CI: Disable test-build-twice job, which is known to fail on trixie
Checksums-Sha1:
 5d580e68fbf81eea11ab0d2382aef780ee8640e6 3992 dovecot_2.4.1+dfsg1-6+deb13u7.dsc
 269572ee0e0af1ca6dfdf180142ecc28f462d945 202952 dovecot_2.4.1+dfsg1-6+deb13u7.debian.tar.xz
 275e296f29f19114b8bc618d1115623daed3e559 7748 dovecot_2.4.1+dfsg1-6+deb13u7_source.buildinfo
Checksums-Sha256:
 c69943573c24825eee761e23deaf0de4fbc7cc251e6c7564916dbe586cbeaa4d 3992 dovecot_2.4.1+dfsg1-6+deb13u7.dsc
 e8831e6dbcbd17fb8485af9bc5c81b48cdb16fd89a8084561f672475236f556d 202952 dovecot_2.4.1+dfsg1-6+deb13u7.debian.tar.xz
 46d4552c23225e205abc6eb8693352f53e3e2de6735a29d60fe1e90882275b20 7748 dovecot_2.4.1+dfsg1-6+deb13u7_source.buildinfo
Files:
 81419335a1847c4d9370af6f43ea3631 3992 mail optional dovecot_2.4.1+dfsg1-6+deb13u7.dsc
 108e44d7bdd4896814eca4a0dc1e899f 202952 mail optional dovecot_2.4.1+dfsg1-6+deb13u7.debian.tar.xz
 929cbc0d5c7969f6167ea2bd5a76ba24 7748 mail optional dovecot_2.4.1+dfsg1-6+deb13u7_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE5G+E0xEKhJuZ7RJ34+c1IpshdTUFAmq5GpkACgkQ4+c1Ipsh
dTXKtxAAu39fM8dWDUz+9LXojP/kj8KLzGtWIy4S0uBhzjT/ye+wcSSN631IRfXz
eckDwXRg3vGiT+IALuk5nl8MMSH5P+kO6xqJV6j4gQclUR5TkTYJUso9rYFmoCNH
njUfF+1fkcGSZeNs/7Blkh2ERPC3yHsxxZ645Nj6UYJDU+nRIkdx5sXGpEzvAW23
zl7WHyfC9tO354k6iCqxQm8mn20B05zF8ZXozObLSOKjU8JA1VnF5YLaKSUkkGIu
qS7DcWMJlniKoB1qUVJSPsIphMWoy3pXIWU+Z++pZmTYzg2HEPPuIoD8oF2c2HQA
bcjCH77mnmbHmTg4CIQU0XjDkolGKSg9bHseE/ehPw+u2q+6SwhgmS+QOLZhgifw
3jrEnkcl54rtrdTtpGLg6Q7GKTUizRVbO0pa5xHuNcdd9sYRjo7hd+n6rkPRs/g8
tyeEDVg/UqAWG8Tyiv08EFat8U3dSXX/fQi7OoNIVMDdCBmO1N9q63gRh8Dld6ZC
KdOn38PAltF5jQM+oMm57zZ39VZBrCDpNdoxdRCnLfMQjuu3bu1ufGyjvJxB80rP
iAOZRvc2pnTDn/J1Z+QDdZbSUPXkZ8TQEX0D5ArCK1g6vNlemv9K95tfeDRTr4Uh
DUMi2PllZ/PoaAo7xAnFYm8vkMSn0wEXPlTRvkIwwnZCE9OYIdo=
=tX12
-----END PGP SIGNATURE-----