Red Hat Security Advisory: dovecot security update

Fixed packages 10

Vulnerabilities 8

• Critical 9.1
  CVE-2026-42007

  An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free…

  Open-Xchange OX Dovecot Pro OX Dovecot CE dovecot Debian Ubuntu Azure Linux Alpine
  Aug 28, 2026
• High 7.5
  CVE-2026-27852

  An attacker that can send mail to a user can craft a message whose headers contain a very large number of email address…

  Open-Xchange OX Dovecot Pro OX Dovecot CE dovecot Debian Ubuntu Azure Linux Alpine
  Aug 28, 2026
• High 7.5
  CVE-2026-33605

  An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authent…

  Open-Xchange OX Dovecot Pro OX Dovecot CE dovecot Debian Ubuntu Azure Linux Alpine
  Aug 28, 2026
• High 7.5
  CVE-2026-42391

  An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which…

  Open-Xchange OX Dovecot Pro OX Dovecot CE dovecot Debian Ubuntu Azure Linux Alpine
  Aug 28, 2026
• High 7.4
  CVE-2026-40018

  None None None No publicly available exploits are known.

  Open-Xchange OX Dovecot Pro OX Dovecot CE dovecot Debian Ubuntu Azure Linux
  Aug 28, 2026
• High 7.4
  CVE-2026-73208

  An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response…

  Open-Xchange OX Dovecot Pro OX Dovecot CE dovecot Debian Ubuntu Azure Linux Alpine
  Aug 28, 2026
• Medium 5.9
  CVE-2026-40019

  An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin …

  Open-Xchange OX Dovecot CE dovecot dovecot Debian Ubuntu Alpine
  Aug 28, 2026
• Medium 4.3
  CVE-2026-33263

  When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused …

  Open-Xchange OX Dovecot Pro OX Dovecot CE dovecot Debian Ubuntu Azure Linux Alpine
  Aug 28, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2525545
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2525547
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2525557
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2525559
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2525567
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2525576
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2525583
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2525584
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98587.json
• report
  https://access.redhat.com/security/cve/CVE-2026-27852
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-27852
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-27852
• article
  https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json
• report
  https://access.redhat.com/security/cve/CVE-2026-33263
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33263
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33263
• report
  https://access.redhat.com/security/cve/CVE-2026-33605
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33605
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33605
• report
  https://access.redhat.com/security/cve/CVE-2026-40018
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-40018
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-40018
• report
  https://access.redhat.com/security/cve/CVE-2026-40019
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-40019
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-40019
• report
  https://access.redhat.com/security/cve/CVE-2026-42007
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-42007
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-42007
• report
  https://access.redhat.com/security/cve/CVE-2026-42391
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-42391
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-42391
• report
  https://access.redhat.com/security/cve/CVE-2026-73208
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-73208
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-73208