Summary
[1:2.3.16-18.8]
- fix CVE-2026-33605: ManageSieve protocol denial of service via
lone CR character (RHEL-251989)
[1:2.3.16-18.7]
- fix CVE-2026-42007: use-after-free in pigeonhole editheader
(RHEL-251952)
[1:2.3.16-18.6]
- fix CVE-2026-40018: incorrect escaping of multi-byte strings in SQL commands (RHEL-252068)
[1:2.3.16-18.5]
- fix CVE-2026-42391: excessive memory growth with pre-login IMAP ID
command (RHEL-251936)
[1:2.3.16-18.4]
- fix CVE-2026-73208: OAuth2 scope check requires all configured scopes, add oauth2_audience setting (RHEL-251911)
[1:2.3.16-18.3]
- fix CVE-2026-27852: limit parsed message data to prevent memory
exhaustion (RHEL-251575)
[1:2.3.16-18.2]
- fix CVE-2026-33263: epoll_ctl panic at
mail_max_userip_connections limit (RHEL-251929)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | dovecot | 1:2.3.16-18.el9_8.8 |
| Oracle Linux · 9 | dovecot-devel | 1:2.3.16-18.el9_8.8 |
| Oracle Linux · 9 | dovecot-mysql | 1:2.3.16-18.el9_8.8 |
| Oracle Linux · 9 | dovecot-pgsql | 1:2.3.16-18.el9_8.8 |
| Oracle Linux · 9 | dovecot-pigeonhole | 1:2.3.16-18.el9_8.8 |
Vulnerabilities 8
-
Critical 9.1
An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free…
-
High 7.5
An attacker that can send mail to a user can craft a message whose headers contain a very large number of email address…
-
High 7.5
An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authent…
-
High 7.5
An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which…
-
High 7.4
None None None No publicly available exploits are known.
-
High 7.4
An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response…
-
Medium 5.9
An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin …
-
Medium 4.3
When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused …