Summary
Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.
Security Fix(es):
* dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)
* dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)
* dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)
* dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)
* dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)
* dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)
* dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)
* dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 40
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 10 | dovecot | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-debuginfo | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-debuginfo | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-debuginfo | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-debuginfo | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-debugsource | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-debugsource | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-debugsource | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-debugsource | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-devel | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-devel | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-devel | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-devel | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-mysql | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-mysql | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-mysql | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-mysql | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-mysql-debuginfo | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-mysql-debuginfo | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-mysql-debuginfo | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-mysql-debuginfo | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-pgsql | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-pgsql | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-pgsql | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-pgsql | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-pgsql-debuginfo | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-pgsql-debuginfo | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-pgsql-debuginfo | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-pgsql-debuginfo | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-pigeonhole | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-pigeonhole | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-pigeonhole | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-pigeonhole | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-pigeonhole-debuginfo | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-pigeonhole-debuginfo | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-pigeonhole-debuginfo | 1:2.3.21-22.el10_3 |
| Rocky Linux · 10 | dovecot-pigeonhole-debuginfo | 1:2.3.21-22.el10_3 |
Vulnerabilities 8
-
Critical 9.1
An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free…
-
High 7.5
An attacker that can send mail to a user can craft a message whose headers contain a very large number of email address…
-
High 7.5
An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authent…
-
High 7.5
An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which…
-
High 7.4
None None None No publicly available exploits are known.
-
High 7.4
An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response…
-
Medium 5.9
An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin …
-
Medium 4.3
When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused …
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2525567
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2525584
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2525547
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2525545
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2525583
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2525576
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2525557
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2525559
-
advisory
https://access.redhat.com/errata/RHSA-2026:98587