dovecot vulnerabilities

It was discovered that Dovecot incorrectly handled invalid base64 SASL data.
An attacker could possibly use this issue to cause a denial of service. This
issue only affected Ubuntu 25.10. (CVE-2025-59028)

It was discovered that Dovecot script decode2text.sh incorrectly handled zip
files. An attacker could possibly use this issue to obtain sensitive
information. (CVE-2025-59031)

It was discovered that Dovecot incorrectly handled certain AUTHENTICATE
requests. An attacker could possibly use this issue to cause a denial of
service. (CVE-2025-59032)

It was discovered that Dovecot incorrectly handled certain SQL based
authentication. An attacker could possibly use this issue to bypass
authentication. This issue only affected Ubuntu 25.10. (CVE-2026-24031)

It was discovered that Dovecot incorrectly handled certain LDAP based
authentication. An attacker could possibly use this issue to bypass
restrictions and allow probing of LDAP structure. This issue only affected
Ubuntu 25.10. (CVE-2026-27860)

It was discovered that Dovecot is vulnerable to replay attack under
certain conditions. An attacker could possibly use this issue to bypass
authentication. (CVE-2026-27855)

It was discovered that Dovecot is vulnerable to a timing attack under
certain conditions. An attacker could possibly use this issue to bypass
authentication. (CVE-2026-27856)

It was discovered that Dovecot incorrectly handled certain IMAP login
requests. An attacker could possibly use this issue to cause a denial of
service. (CVE-2026-27857)

It was discovered that Dovecot incorrectly handled certain specially
crafted messages. An attacker could possibly use this issue to cause a
denial of service. (CVE-2026-27858)

It was discovered that Dovecot incorrectly handled certain specially
crafted mail messages. An attacker could possibly use this issue to
cause a denial of service. (CVE-2026-27859)

It was discovered that Dovecot incorrectly handles file paths. A attacker
could possibly use this issue to perform a path traversal and obtain or
modify arbitrary files. This issue only affected Ubuntu 22.04 LTS and
Ubuntu 24.04 LTS. (CVE-2026-0394)