Description
Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | dovecot | dovecot 2.2.29 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dovecot | 1:2.2.27-3 | — |
| Debian 13 | dovecot | 1:2.2.27-3 | — |
| Debian 12 | dovecot | 1:2.2.27-3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | dovecot | 1:2.2.22-1ubuntu2.3 | USN-3258-2, USN-3258-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | dovecot | 2.2-3.1 | SUSE-SU-2017:1250-1 |
| SLES 12 SP2 | dovecot22 | 2.2.29.1-11.1 | SUSE-SU-2017:1250-1 |
| SLES 12 SP1 | dovecot | 2.2-3.1 | SUSE-SU-2017:1250-1 |
| SLES 12 SP1 | dovecot22 | 2.2.29.1-11.1 | SUSE-SU-2017:1250-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP2 | dovecot | 2.2-3.1 | SUSE-SU-2017:1250-1 |
| SLES for SAP 12 SP2 | dovecot22 | 2.2.29.1-11.1 | SUSE-SU-2017:1250-1 |
| SLES for SAP 12 SP1 | dovecot | 2.2-3.1 | SUSE-SU-2017:1250-1 |
| SLES for SAP 12 SP1 | dovecot22 | 2.2.29.1-11.1 | SUSE-SU-2017:1250-1 |
Advisories 3
- USN-3258-1 dovecot vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- USN-3258-2 dovecot regression Ubuntu Security Notices (USN) · Apr 22, 2026
- SUSE-SU-2017:1250-1 Security update for dovecot22 SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [dovecot-news] 20170410 v2.2.29 released mailing-list
- [oss-security] 20170411 CVE-2017-2669: Dovecot DoS when passdb dict was used for authentication mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2669
- https://github.com/dovecot/core/commit/000030feb7a30f193197f1aab8a7b04a26b42735.patch
- DSA-3828 vendor-advisory
- 97536 vdb-entry