Dovecot: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 12

• High 7.7
  CVE-2026-24031 Public exploit

  Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allow…

  Open-Xchange OX Dovecot Pro dovecot dovecot Debian Ubuntu Azure Linux Alpine
  Mar 27, 2026
• High 7.5
  CVE-2025-59032

  ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageS…

  Open-Xchange OX Dovecot Pro dovecot dovecot Debian Ubuntu Azure Linux
  Mar 27, 2026
• High 7.5
  CVE-2026-27858

  Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount…

  Open-Xchange OX Dovecot Pro dovecot dovecot Debian Ubuntu Azure Linux
  Mar 27, 2026
• High 7.4
  CVE-2025-30189

  When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached…

  Open-Xchange OX Dovecot Pro dovecot dovecot Debian Ubuntu Azure Linux Alpine
  Oct 31, 2025
• High 7.4
  CVE-2026-27856

  Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can …

  Open-Xchange OX Dovecot Pro dovecot dovecot Debian Ubuntu Azure Linux Alpine
  Mar 27, 2026
• Medium 6.8
  CVE-2026-27855

  Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and user…

  Open-Xchange OX Dovecot Pro dovecot dovecot Debian Ubuntu Azure Linux Alpine
  Mar 27, 2026
• Medium 5.3
  CVE-2025-59028

  When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentic…

  Open-Xchange OX Dovecot Pro dovecot dovecot Debian Ubuntu Azure Linux Alpine
  Mar 27, 2026
• Medium 5.3
  CVE-2026-0394

  When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or …

  Open-Xchange OX Dovecot Pro dovecot dovecot Debian Ubuntu Azure Linux
  Mar 27, 2026
• Medium 5.3
  CVE-2026-27859

  A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU. A suitably form…

  Open-Xchange OX Dovecot Pro dovecot dovecot Debian Ubuntu Azure Linux Alpine
  Mar 27, 2026
• Medium 4.3
  CVE-2025-59031

  Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachme…

  Open-Xchange OX Dovecot Pro dovecot dovecot Debian Ubuntu Azure Linux Alpine
  Mar 27, 2026
• Medium 4.3
  CVE-2026-27857

  Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands w…

  Open-Xchange OX Dovecot Pro dovecot dovecot Debian Ubuntu Azure Linux Alpine
  Mar 27, 2026
• Low 3.7
  CVE-2026-27860

  If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This …

  Open-Xchange OX Dovecot Pro dovecot dovecot Debian Ubuntu Azure Linux Alpine
  Mar 27, 2026

Revision history

1. 2026-09-16 #23

   Neue Updates von SUSE aufgenommen

2. 2026-08-10 #22

   Neue Updates von Oracle Linux aufgenommen

3. 2026-08-05 #21

   Neue Updates aufgenommen

4. 2026-07-16 #20

   Neue Updates von Oracle Linux aufgenommen

5. 2026-06-24 #19

   Neue Updates von Oracle Linux aufgenommen

6. 2026-06-17 #18

   Neue Updates von Red Hat aufgenommen

7. 2026-06-07 #17

   Neue Updates von Debian aufgenommen

8. 2026-05-19 #16

   Neue Updates von Red Hat aufgenommen

9. 2026-05-18 #15

   Neue Updates von Red Hat und Fedora aufgenommen

10. 2026-05-14 #14

    Neue Updates von Red Hat aufgenommen

11. 2026-05-07 #13

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

12. 2026-05-06 #12

    Neue Updates von Oracle Linux und Rocky Enterprise Software Foundation aufgenommen

13. 2026-05-05 #11

    Neue Updates von Red Hat und Oracle Linux aufgenommen

14. 2026-05-04 #10

    Neue Updates von Red Hat aufgenommen

15. 2026-05-03 #9

    Neue Updates von Debian aufgenommen

16. 2026-04-29 #8

    Neue Updates von Amazon aufgenommen

17. 2026-04-28 #7

    Neue Updates von Ubuntu und SUSE aufgenommen

18. 2026-04-21 #6

    Neue Updates von openSUSE und SUSE aufgenommen

19. 2026-04-06 #5

    Neue Updates von Debian aufgenommen

20. 2026-03-31 #4

    Neue Updates von Ubuntu aufgenommen

21. 2026-03-30 #3

    Neue Updates von openSUSE aufgenommen

22. 2026-03-29 #2

    Referenz(en) aufgenommen: EUVD-2026-16573, EUVD-2025-209092, EUVD-2026-16559, EUVD-2026-16561, EUVD-2026-16563, EUVD-2026-16565, EUVD-2026-16571, EUVD-2026-16567

23. 2026-03-26 #1

    Initiale Fassung

References

• Dovecot Security Advisory vom 2026-03-26
  https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/I4KFFV4IKP6M5MS67SWYHKDSDMSNILQG/
• openSUSE Security Update OPENSUSE-SU-2026:10442-1 vom 2026-03-30
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OBSVSMBRLSXDJ3TFA22MX7UVQIY2WIIN/
• Ubuntu Security Notice USN-8136-1 vom 2026-03-31
  https://ubuntu.com/security/notices/USN-8136-1
• Debian Security Advisory DSA-6197 vom 2026-04-07
  https://lists.debian.org/debian-security-announce/2026/msg00106.html
• Debian Security Advisory DSA-6197 vom 2026-04-06
  https://lists.debian.org/debian-security-announce/2026/msg00110.html
• openSUSE Security Update OPENSUSE-SU-2026:20554-1 vom 2026-04-21
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VMHMIYO6TS5ZV5BWW5FJU4VM35MQ7MJN/
• SUSE Security Update SUSE-SU-2026:21208-1 vom 2026-04-21
  https://lists.suse.com/pipermail/sle-security-updates/2026-April/025494.html
• Ubuntu Security Notice USN-8136-2 vom 2026-04-28
  https://ubuntu.com/security/notices/USN-8136-2
• SUSE Security Update SUSE-SU-2026:1641-1 vom 2026-04-28
  https://lists.suse.com/pipermail/sle-security-updates/2026-April/025755.html
• Amazon Linux Security Advisory ALAS2-2026-3252 vom 2026-04-30
  https://alas.aws.amazon.com/AL2/ALAS2-2026-3252.html
• Debian Security Advisory DLA-4556 vom 2026-05-01
  https://lists.debian.org/debian-lts-announce/2026/05/msg00000.html
• Red Hat Security Advisory RHSA-2026:13498 vom 2026-05-04
  https://access.redhat.com/errata/RHSA-2026:13498
• Red Hat Security Advisory RHSA-2026:13830 vom 2026-05-05
  https://access.redhat.com/errata/RHSA-2026:13830
• Oracle Linux Security Advisory ELSA-2026-13498 vom 2026-05-06
  https://linux.oracle.com/errata/ELSA-2026-13498.html
• Red Hat Security Advisory RHSA-2026:13857 vom 2026-05-05
  https://access.redhat.com/errata/RHSA-2026:13857
• Oracle Linux Security Advisory ELSA-2026-13857 vom 2026-05-07
  http://linux.oracle.com/errata/ELSA-2026-13857.html
• Rocky Linux Security Advisory RLSA-2026:13830 vom 2026-05-07
  https://errata.build.resf.org/RLSA-2026:13830
• Oracle Linux Security Advisory ELSA-2026-13830 vom 2026-05-07
  http://linux.oracle.com/errata/ELSA-2026-13830.html
• Rocky Linux Security Advisory RLSA-2026:13498 vom 2026-05-06
  https://errata.build.resf.org/RLSA-2026:13498
• Rocky Linux Security Advisory RLSA-2026:13857 vom 2026-05-07
  https://errata.build.resf.org/RLSA-2026:13857
• Red Hat Security Advisory RHSA-2026:17626 vom 2026-05-14
  https://access.redhat.com/errata/RHSA-2026:17626
• Red Hat Security Advisory RHSA-2026:17628 vom 2026-05-15
  https://access.redhat.com/errata/RHSA-2026:17628
• Red Hat Security Advisory RHSA-2026:17630 vom 2026-05-14
  https://access.redhat.com/errata/RHSA-2026:17630
• Red Hat Security Advisory RHSA-2026:17602 vom 2026-05-14
  https://access.redhat.com/errata/RHSA-2026:17602
• Red Hat Security Advisory RHSA-2026:17625 vom 2026-05-14
  https://access.redhat.com/errata/RHSA-2026:17625
• Red Hat Security Advisory RHSA-2026:18053 vom 2026-05-18
  https://access.redhat.com/errata/RHSA-2026:18053
• Fedora Security Advisory FEDORA-2026-693373747F vom 2026-05-18
  https://bodhi.fedoraproject.org/updates/FEDORA-2026-693373747f
• Fedora Security Advisory FEDORA-2026-96EEB03B88 vom 2026-05-18
  https://bodhi.fedoraproject.org/updates/FEDORA-2026-96eeb03b88
• Red Hat Security Advisory RHSA-2026:19455 vom 2026-05-20
  https://access.redhat.com/errata/RHSA-2026:19455
• Red Hat Security Advisory RHSA-2026:19364 vom 2026-05-19
  https://access.redhat.com/errata/RHSA-2026:19364
• Red Hat Security Advisory RHSA-2026:19149 vom 2026-05-20
  https://access.redhat.com/errata/RHSA-2026:19149
• Red Hat Security Advisory RHSA-2026:19453 vom 2026-05-20
  https://access.redhat.com/errata/RHSA-2026:19453
• Debian Security Advisory DLA-4617 vom 2026-06-05
  https://lists.debian.org/debian-lts-announce/2026/06/msg00006.html
• Red Hat Security Advisory RHSA-2026:26564 vom 2026-06-17
  https://access.redhat.com/errata/RHSA-2026:26564
• Oracle Linux Security Advisory ELSA-2026-19364 vom 2026-06-25
  http://linux.oracle.com/errata/ELSA-2026-19364.html
• Oracle Linux Security Advisory ELSA-2026-19149 vom 2026-07-17
  https://linux.oracle.com/errata/ELSA-2026-19149.html
• cPanel & WHM Change Log
  https://docs.cpanel.net/changelogs/110-change-log/
• Oracle Linux Security Advisory ELSA-2026-49513 vom 2026-08-11
  https://linux.oracle.com/errata/ELSA-2026-49513.html
• Oracle Linux Security Advisory ELSA-2026-26564 vom 2026-08-11
  https://linux.oracle.com/errata/ELSA-2026-26564.html
• SUSE Security Update SUSE-SU-2026:4139-1 vom 2026-09-16
  https://lists.suse.com/pipermail/sle-security-updates/2026-September/029056.html