Hi,
The following vulnerabilities were published for dovecot.
CVE-2026-27852[0]:
| An attacker that can send mail to a user can craft a message whose
| headers contain a very large number of email addresses or MIME
| parameters, which causes excessive memory usage when the message is
| later parsed. The message is still delivered, but reading it over
| IMAP can exhaust the memory limit of the process and terminate it,
| causing denial of service for the affected user. Update to non-
| vulnerable version. No publicly available exploits are known.
CVE-2026-33263[1]:
| When mail_max_userip_connections is set (default 10) and reached,
| submission-login can crash with epoll() panic caused by file
| descriptor handling issues. If running in high-security mode
| (default for community releases), only the new submission connection
| gets terminated. If running in high-performance mode (default for
| Pro releases), all connections handled by the submission-login
| process will be terminated. The crashes can cause failure for user
| to send a message, or it can cause duplicate messages to be sent. If
| TLS is not used (in the backend server processing the submission),
| duplicate deliveries cannot happen, because the crash can only
| happen at AUTH stage. Limit the number of connections handled by
| single submission-login process. This has a performance impact
| though. Update to non-vulnerable version. No publicly available
| exploits are known.
CVE-2026-33604[2]:
| An attacker that can get Dovecot to relay a message, for example
| through Sieve redirect or submission relay, can use a crafted line
| ending in the message body to bypass the outbound protection that
| prevents message content from being interpreted as SMTP commands. A
| downstream mail server that hasn't yet fixed the SMTP smuggling
| vulnerability can be tricked into treating part of the message body
| as new SMTP commands, allowing injection of spoofed email. This is
| the same vulnerability class as CVE-2023-51764 and CVE-2023-51766.
| Where you control the receiving mail servers, ensure they reject
| bare carriage returns in message data. Update to non-vulnerable
| version. No publicly available exploits are known.
CVE-2026-33605[3]:
| An unauthenticated attacker can crash the ManageSieve login process
| by sending a small malformed command before authenticating. If
| running in high-security mode (default for community releases), only
| the attacker's own connection is terminated. If running in high-
| performance mode (default for Pro releases), all connections handled
| by the same managesieve-login process are terminated. Repeating the
| attack can cause denial of service for Sieve script management.
| Restrict network access to the ManageSieve service to trusted
| clients. Update to non-vulnerable version. No publicly available
| exploits are known.
CVE-2026-33606[4]:
| Mail content stored by a user can be crafted so that it is
| interpreted as dsync protocol commands when an administrator later
| runs dsync with the stream protocol, for example during a migration.
| Injected commands can modify mailbox state on the destination during
| migration or replication, including internal mailbox attributes that
| a user should not be able to set directly. It can also cause dsync
| errors. Avoid running dsync with the stream protocol on mailboxes
| with untrusted content. Update to non-vulnerable version. No
| publicly available exploits are known.
CVE-2026-33607[5]:
| An attacker that has valid credentials can use IMAP LIST command to
| consume CPU. This can cause degradation or denial of service for
| IMAP. Monitor system for abnormal CPU usage and kill the offending
| process and lock account. Alternatively install fixed version. No
| publicly available exploits are known.
CVE-2026-40013[6]:
| An attacker that has valid credentials can submit a Sieve script
| containing an extreme numeric literal, which causes an out-of-bounds
| write when the ManageSieve service compiles the script. This causes
| memory corruption and an observed crash of the ManageSieve process,
| resulting in denial of service for script management. This might be
| able to be used for remote code execution. Disable the ManageSieve
| service if users do not need remote Sieve script management. Update
| to non-vulnerable version. No publicly available exploits are known.
CVE-2026-40014[7]:
| An attacker that can send mail to a user can craft a message header
| that makes the IMAP THREAD command consume CPU disproportionate to
| the size of the message. When a mail client issues a THREAD command
| on the affected mailbox, this can cause degradation or denial of
| service for IMAP. Monitor system for abnormal CPU usage, kill the
| offending process and remove the offending message from the affected
| mailbox. Update to non-vulnerable version. No publicly available
| exploits are known.
CVE-2026-40015[8]:
| An attacker that has valid credentials can open many connections to
| the imap-hibernate service and send invalid commands, which can
| intermittently cause an out-of-bounds read and crash the process.
| The crash interrupts hibernated IMAP sessions handled by the
| affected process, which can cause degradation of service for IMAP.
| Disable IMAP hibernation. Update to non-vulnerable version. No
| publicly available exploits are known.
CVE-2026-40017[9]:
| An attacker that can send mail to a user can craft a message header
| whose values are chosen to collide in an internal hash table, which
| makes the IMAP THREAD command consume CPU disproportionate to the
| size of the message. This is a separate issue from CVE-2026-40014
| and is not addressed by that fix. Whenever a mail client issues a
| THREAD command on the affected mailbox, this can cause degradation
| or denial of service for IMAP. Monitor system for abnormal CPU
| usage, kill the offending process and remove the offending message
| from the affected mailbox. Update to non-vulnerable version. No
| publicly available exploits are known.
CVE-2026-40018[10]:
| None None None No publicly available exploits are known.
CVE-2026-40019[11]:
| An unauthenticated attacker can send a truncated quoted argument to
| the ManageSieve login process, which makes it spin in an infinite
| loop consuming CPU. This can cause degradation or denial of service
| for Sieve script management, and repeated connections can consume
| all available CPU on the server. Monitor system for abnormal CPU
| usage and kill the offending process. Restrict network access to the
| ManageSieve service to trusted clients. Update to non-vulnerable
| version. No publicly available exploits are known.
CVE-2026-40203[12]:
| When IMAP compression is enabled, the same compression state is
| reused across responses in a session, so response sizes depend on
| both attacker-supplied mail and other mail in the same mailbox. An
| attacker that can send mail to a user and can also observe the sizes
| of that user's IMAP traffic can confirm whether the body of a small
| message matches a guessed text. Recovery of arbitrary unknown
| content was not demonstrated, but the attack can disclose whether a
| secret-like message body matches a candidate. Disable IMAP
| compression. Update to non-vulnerable version. No publicly available
| exploits are known.
CVE-2026-40204[13]:
| None None None No publicly available exploits are known.
CVE-2026-40205[14]:
| An attacker that holds an OAuth2 token granting only part of the
| required scopes can authenticate, because when more than one scope
| is required in the configuration, the remote token validation paths
| accept a token that carries only one of them, while the local token
| validation path correctly requires all of them. The configured
| authorization policy is not enforced, so a token that was granted
| only part of the required permissions is accepted where it should
| have been rejected. Use local token validation where tokens can be
| validated locally. Update to non-vulnerable version. No publicly
| available exploits are known.
CVE-2026-42007[15]:
| An attacker that has valid credentials can use a Sieve script with
| the editheader extension to trigger a use-after-free in the mail
| editing code, and to write memory contents beyond the intended
| buffer into the delivered mail. This causes memory leak and
| opportunity to do memory corruption during mail delivery, which can
| crash the delivery process and may allow execution of arbitrary code
| in the context of that process. Disable the Sieve editheader
| extension. Update to non-vulnerable version. No publicly available
| exploits are known.
CVE-2026-42008[16]:
| Forwarding information received from a host listed as a trusted
| proxy is not kept separate from Dovecot's own authentication fields,
| so a value sent by that host can be injected as an internal
| authentication field. Any host permitted to act as a trusted proxy
| can authenticate as any user without knowing that user's password.
| This affects deployments whose password database honours a field
| that permits authentication without a password. Deployments that do
| not configure trusted proxies are not affected. Restrict the list of
| trusted proxy networks to hosts that are fully under your control.
| Update to non-vulnerable version. No publicly available exploits are
| known.
CVE-2026-42391[17]:
| An unauthenticated attacker can send an IMAP ID command with a very
| large number of parameters before logging in, which causes memory
| and CPU usage to grow disproportionately. The login process can be
| terminated by the out-of-memory handling, which also terminates all
| other connections handled by the same process. This can cause
| degradation or denial of service for IMAP logins. Limit the number
| of connections handled by a single imap-login process. This has a
| performance impact though. Update to non-vulnerable version. No
| publicly available exploits are known.
CVE-2026-42392[18]:
| An attacker that has valid credentials can send an invalid IMAP
| URLFETCH command, which causes uninitialized memory to be included
| in the error response returned to the client. Process memory
| contents can be disclosed to the client, which may include sensitive
| data. Disable the IMAP URLAUTH functionality. Update to non-
| vulnerable version. No publicly available exploits are known.
CVE-2026-42393[19]:
| The comparison used for the doveadm password and API key is not
| fully timing safe and can reveal the length of the configured
| secret. An attacker with access to the same network as the doveadm
| service, able to make repeated requests and measure response timing
| accurately, can learn the length of the secret, which reduces the
| effort needed to guess it. The secret value itself is not disclosed.
| Restrict network access to the doveadm service to trusted clients.
| Update to non-vulnerable version. No publicly available exploits are
| known.
CVE-2026-42395[20]:
| A host listed as a trusted proxy can send forwarding information
| containing a NUL byte, which crashes the login process on the
| following login attempt. The login process is terminated, which can
| cause degradation or denial of service for logins. Deployments that
| do not configure trusted proxies are not affected. Restrict the list
| of trusted proxy networks to hosts that are fully under your
| control. Update to non-vulnerable version. No publicly available
| exploits are known.
CVE-2026-52681[21]:
| Sieve CPU resource usage is tracked in the compiled script, so an
| attacker that has valid credentials can reset the accounting by
| repeatedly changing the active script. Compiled script files are
| also not removed when a script is deleted or renamed. The configured
| Sieve CPU limit can be bypassed, allowing sustained CPU consumption,
| and the leftover files increase disk consumption. Both can cause
| degradation of service for mail delivery. Monitor system for
| abnormal CPU usage and disk consumption. Update to non-vulnerable
| version. No publicly available exploits are known.
CVE-2026-52687[22]:
| An attacker that has valid credentials can select a compression
| algorithm for the IMAP connection whose decompression state requires
| a large amount of memory, and open several such connections. The
| memory limit of the process is reached with only a few connections,
| terminating the process and all connections it handles, which can
| cause degradation or denial of service for IMAP. Disable IMAP
| compression. Alternatively limit the number of connections handled
| by a single imap-login process, though this has a performance
| impact. Update to non-vulnerable version. No publicly available
| exploits are known.
CVE-2026-73208[23]:
| An attacker that holds a token intended for a different purpose can
| authenticate, because when an OAuth2 token response does not contain
| a scope claim, the audience claim is used in its place and checked
| against the configured required scopes. These are different
| concepts, and the audience claim does not describe what a token is
| allowed to do. A token that grants no relevant permissions can be
| accepted because its intended recipient value happens to match a
| configured scope name, granting access that should have been denied.
| It also hides an identity provider misconfiguration where scopes are
| not being issued at all. Ensure the identity provider issues a scope
| claim for all tokens used with Dovecot, and that configured scope
| names do not match audience values. Update to non-vulnerable
| version. No publicly available exploits are known.
CVE-2026-73209[24]:
| An attacker that has valid credentials can send crafted compressed
| data that causes the affected process to exhaust its stack and
| crash. The affected process is terminated, which can cause
| degradation or denial of service for IMAP. Update to non-vulnerable
| version. No publicly available exploits are known.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-27852
https://www.cve.org/CVERecord?id=CVE-2026-27852
[1] https://security-tracker.debian.org/tracker/CVE-2026-33263
https://www.cve.org/CVERecord?id=CVE-2026-33263
[2] https://security-tracker.debian.org/tracker/CVE-2026-33604
https://www.cve.org/CVERecord?id=CVE-2026-33604
[3] https://security-tracker.debian.org/tracker/CVE-2026-33605
https://www.cve.org/CVERecord?id=CVE-2026-33605
[4] https://security-tracker.debian.org/tracker/CVE-2026-33606
https://www.cve.org/CVERecord?id=CVE-2026-33606
[5] https://security-tracker.debian.org/tracker/CVE-2026-33607
https://www.cve.org/CVERecord?id=CVE-2026-33607
[6] https://security-tracker.debian.org/tracker/CVE-2026-40013
https://www.cve.org/CVERecord?id=CVE-2026-40013
[7] https://security-tracker.debian.org/tracker/CVE-2026-40014
https://www.cve.org/CVERecord?id=CVE-2026-40014
[8] https://security-tracker.debian.org/tracker/CVE-2026-40015
https://www.cve.org/CVERecord?id=CVE-2026-40015
[9] https://security-tracker.debian.org/tracker/CVE-2026-40017
https://www.cve.org/CVERecord?id=CVE-2026-40017
[10] https://security-tracker.debian.org/tracker/CVE-2026-40018
https://www.cve.org/CVERecord?id=CVE-2026-40018
[11] https://security-tracker.debian.org/tracker/CVE-2026-40019
https://www.cve.org/CVERecord?id=CVE-2026-40019
[12] https://security-tracker.debian.org/tracker/CVE-2026-40203
https://www.cve.org/CVERecord?id=CVE-2026-40203
[13] https://security-tracker.debian.org/tracker/CVE-2026-40204
https://www.cve.org/CVERecord?id=CVE-2026-40204
[14] https://security-tracker.debian.org/tracker/CVE-2026-40205
https://www.cve.org/CVERecord?id=CVE-2026-40205
[15] https://security-tracker.debian.org/tracker/CVE-2026-42007
https://www.cve.org/CVERecord?id=CVE-2026-42007
[16] https://security-tracker.debian.org/tracker/CVE-2026-42008
https://www.cve.org/CVERecord?id=CVE-2026-42008
[17] https://security-tracker.debian.org/tracker/CVE-2026-42391
https://www.cve.org/CVERecord?id=CVE-2026-42391
[18] https://security-tracker.debian.org/tracker/CVE-2026-42392
https://www.cve.org/CVERecord?id=CVE-2026-42392
[19] https://security-tracker.debian.org/tracker/CVE-2026-42393
https://www.cve.org/CVERecord?id=CVE-2026-42393
[20] https://security-tracker.debian.org/tracker/CVE-2026-42395
https://www.cve.org/CVERecord?id=CVE-2026-42395
[21] https://security-tracker.debian.org/tracker/CVE-2026-52681
https://www.cve.org/CVERecord?id=CVE-2026-52681
[22] https://security-tracker.debian.org/tracker/CVE-2026-52687
https://www.cve.org/CVERecord?id=CVE-2026-52687
[23] https://security-tracker.debian.org/tracker/CVE-2026-73208
https://www.cve.org/CVERecord?id=CVE-2026-73208
[24] https://security-tracker.debian.org/tracker/CVE-2026-73209
https://www.cve.org/CVERecord?id=CVE-2026-73209
Regards,
Salvatore