Summary
[1:2.3.21-19.8]
- fix CVE-2026-33605: ManageSieve: denial of service via lone CR
character causing protocol deadlock (RHEL-251984)
[1:2.3.21-19.7]
- fix CVE-2026-42007: fix use-after-free and info leak in sieve
editheader extension (RHEL-251945)
[1:2.3.21-19.6]
- fix CVE-2026-40018: incorrect escaping of multi-byte strings in SQL commands (RHEL-252058)
[1:2.3.21-19.5]
- fix CVE-2026-42391: fix excessive memory growth with pre-login ID
command (RHEL-252072)
[1:2.3.21-19.4]
- fix CVE-2026-73208: OAuth2 scope check requires all configured scopes, add oauth2_audience setting (RHEL-251900)
[1:2.3.21-19.3]
- fix CVE-2026-27852: limit parsed message data to prevent memory exhaustion (RHEL-251564)
[1:2.3.21-19.2]
- fix CVE-2026-33263: submission-login epoll panic at
mail_max_userip_connections limit (RHEL-251917)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | dovecot | 1:2.3.21-19.el10_2.8 |
| Oracle Linux · 10 | dovecot-devel | 1:2.3.21-19.el10_2.8 |
| Oracle Linux · 10 | dovecot-mysql | 1:2.3.21-19.el10_2.8 |
| Oracle Linux · 10 | dovecot-pgsql | 1:2.3.21-19.el10_2.8 |
| Oracle Linux · 10 | dovecot-pigeonhole | 1:2.3.21-19.el10_2.8 |
Vulnerabilities 8
-
Critical 9.1
An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free…
-
High 7.5
An attacker that can send mail to a user can craft a message whose headers contain a very large number of email address…
-
High 7.5
An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authent…
-
High 7.5
An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which…
-
High 7.4
None None None No publicly available exploits are known.
-
High 7.4
An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response…
-
Medium 5.9
An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin …
-
Medium 4.3
When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused …