Summary
[1:2.3.16-15.1]
- fix CVE-2026-27858: denial of service via crafted message before authentication (RHEL-161639)
- fix CVE-2025-59032: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (RHEL-162287)
- fix CVE-2026-27857: denial of service via specially crafted NOOP command (RHEL-161678)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | dovecot | 1:2.3.16-15.el9_7.1 |
| Oracle Linux · 9 | dovecot-devel | 1:2.3.16-15.el9_7.1 |
| Oracle Linux · 9 | dovecot-mysql | 1:2.3.16-15.el9_7.1 |
| Oracle Linux · 9 | dovecot-pgsql | 1:2.3.16-15.el9_7.1 |
| Oracle Linux · 9 | dovecot-pigeonhole | 1:2.3.16-15.el9_7.1 |
Vulnerabilities 3
-
High 7.5
ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageS…
-
High 7.5
Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount…
-
Medium 4.3
Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands w…