Summary
[1:2.3.16-15]
- fix CVE-2026-33605: ManageSieve login deadlock caused by lone CR
protocol violation (RHEL-251995)
[1:2.3.16-14]
- fix CVE-2026-42007: heap use-after-free in pigeonhole edit_mail_snapshot
after deleteheader operation (RHEL-251946)
[1:2.3.16-13]
- fix CVE-2026-40018: incorrect escaping of multi-byte strings in SQL commands (RHEL-252064)
[1:2.3.16-13]
- fix CVE-2026-42391: pre-auth CPU/memory amplification via
excessive ID command key/value pairs (RHEL-252056)
[1:2.3.16-12]
- fix CVE-2026-73208: OAuth2 scope check requires all configured scopes, add oauth2_audience setting (RHEL-251905)
[1:2.3.16-11]
- fix CVE-2026-27852: denial of service via memory exhaustion from
crafted message headers (RHEL-251573)
[1:2.3.16-10]
- fix CVE-2026-33263: submission-login panic at
mail_max_userip_connections limit (RHEL-251922)
[1:2.3.16-9]
- fix mailbox leak causing assert crash (RHEL-176273)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | dovecot | 1:2.3.16-16.el8_10 |
| Oracle Linux · 8 | dovecot-devel | 1:2.3.16-16.el8_10 |
| Oracle Linux · 8 | dovecot-mysql | 1:2.3.16-16.el8_10 |
| Oracle Linux · 8 | dovecot-pgsql | 1:2.3.16-16.el8_10 |
| Oracle Linux · 8 | dovecot-pigeonhole | 1:2.3.16-16.el8_10 |
Vulnerabilities 8
-
Critical 9.1
An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free…
-
High 7.5
An attacker that can send mail to a user can craft a message whose headers contain a very large number of email address…
-
High 7.5
An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authent…
-
High 7.5
An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which…
-
High 7.4
None None None No publicly available exploits are known.
-
High 7.4
An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response…
-
Medium 5.9
An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin …
-
Medium 4.3
When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused …