High ELSA-2026-41905 1 CVE

Important: dovecot security update (Oracle Linux 9)

Published Jul 20, 2026 · Updated Jul 20, 2026

Ecosystem: Oracle Linux

Summary

[1:2.3.16-18.1]
- fix CVE-2026-42006: IMAP parser list_count_limit bypass via open
parentheses (RHEL-188468)

Fixed packages 5

Release	Package	Fixed in
Oracle Linux · 9	dovecot	1:2.3.16-18.el9_8.1
Oracle Linux · 9	dovecot-devel	1:2.3.16-18.el9_8.1
Oracle Linux · 9	dovecot-mysql	1:2.3.16-18.el9_8.1
Oracle Linux · 9	dovecot-pgsql	1:2.3.16-18.el9_8.1
Oracle Linux · 9	dovecot-pigeonhole	1:2.3.16-18.el9_8.1

Vulnerabilities 1

Medium 4.3

CVE-2026-42006

An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incompl…

Open-Xchange OX Dovecot Pro dovecot dovecot Debian Ubuntu Azure Linux Alpine

May 12, 2026