Red Hat Security Advisory: dovecot security update

Fixed packages 6

Vulnerabilities 4

• High 7.5
  CVE-2025-59032

  ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageS…

  Open-Xchange OX Dovecot Pro dovecot dovecot Debian Ubuntu Azure Linux
  Mar 27, 2026
• High 7.5
  CVE-2026-27858

  Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount…

  Open-Xchange OX Dovecot Pro dovecot dovecot Debian Ubuntu Azure Linux
  Mar 27, 2026
• High 7.4
  CVE-2026-27856

  Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can …

  Open-Xchange OX Dovecot Pro dovecot dovecot Debian Ubuntu Azure Linux Alpine
  Mar 27, 2026
• Medium 4.3
  CVE-2026-27857

  Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands w…

  Open-Xchange OX Dovecot Pro dovecot dovecot Debian Ubuntu Azure Linux Alpine
  Mar 27, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2452171
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2452172
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2452175
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2452179
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26564.json
• report
  https://access.redhat.com/security/cve/CVE-2025-59032
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-59032
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-59032
• article
  https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json
• report
  https://access.redhat.com/security/cve/CVE-2026-27856
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-27856
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-27856
• report
  https://access.redhat.com/security/cve/CVE-2026-27857
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-27857
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-27857
• report
  https://access.redhat.com/security/cve/CVE-2026-27858
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-27858
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-27858