High ELSA-2026-41988 1 CVE

Important: dovecot security update (Oracle Linux 10)

Published Jul 20, 2026 · Updated Jul 20, 2026

Ecosystem: Oracle Linux

Summary

[1:2.3.21-19.1]
- fix CVE-2026-42006: fix imap_parser list_count_limit to actually
work (RHEL-188477)

Fixed packages 5

Release	Package	Fixed in
Oracle Linux · 10	dovecot	1:2.3.21-19.el10_2.1
Oracle Linux · 10	dovecot-devel	1:2.3.21-19.el10_2.1
Oracle Linux · 10	dovecot-mysql	1:2.3.21-19.el10_2.1
Oracle Linux · 10	dovecot-pgsql	1:2.3.21-19.el10_2.1
Oracle Linux · 10	dovecot-pigeonhole	1:2.3.21-19.el10_2.1

Vulnerabilities 1

Medium 4.3

CVE-2026-42006

An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incompl…

Open-Xchange OX Dovecot Pro dovecot dovecot Debian Ubuntu Azure Linux Alpine

May 12, 2026