Summary
Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.
Security Fix(es):
* dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032)
* dovecot: denial of service via crafted message before authentication (CVE-2026-27858)
* dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | dovecot | 1:2.3.16-18.el9_8 |
| AlmaLinux · 9 | dovecot-devel | 1:2.3.16-18.el9_8 |
| AlmaLinux · 9 | dovecot-mysql | 1:2.3.16-18.el9_8 |
| AlmaLinux · 9 | dovecot-pgsql | 1:2.3.16-18.el9_8 |
| AlmaLinux · 9 | dovecot-pigeonhole | 1:2.3.16-18.el9_8 |
Vulnerabilities 3
-
High 7.5
ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageS…
-
High 7.5
Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount…
-
Medium 4.3
Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands w…
References
-
report
https://access.redhat.com/security/cve/CVE-2025-59032
-
report
https://access.redhat.com/security/cve/CVE-2026-27857
-
report
https://access.redhat.com/security/cve/CVE-2026-27858
-
report
https://bugzilla.redhat.com/2452172
-
report
https://bugzilla.redhat.com/2452175
-
report
https://bugzilla.redhat.com/2452179
-
advisory
https://errata.almalinux.org/9/ALSA-2026-19364.html