Description
When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users. After cached login, all subsequent logins are for same user. Install fixed version or disable caching either globally or for the impacted passdb/userdb drivers. No publicly available exploits are known.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Open-Xchange | OX Dovecot Pro | ≤ 3.1.0, ≤ 2.4.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dovecot | 1:2.4.1+dfsg1-7 | — |
| Debian 13 | dovecot | 1:2.4.1+dfsg1-6+deb13u1 | DSA-6019-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | dovecot | 1:2.4.1+dfsg1-5ubuntu4 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | dovecot24 | 2.4.2-160000.1.1 | SUSE-SU-2025:21159-1 |
| SLES 16.0 | dovecot24 | 2.4.2-160000.1.1 | SUSE-SU-2025:21159-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | dovecot24 | 2.4.2-1.1 | openSUSE-SU-2025:15676-1 |
| openSUSE Leap 16.0 | dovecot24 | 2.4.2-160000.1.1 | openSUSE-SU-2025:20113-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | dovecot | 2.4.2-r0 | — |
| Alpine v3.23 | dovecot | 2.4.2-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | dovecot | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | dovecot | No fix yet | — |
Advisories 6
- WID-SEC-2026-0891 Dovecot: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 16, 2026
- openSUSE-SU-2025:20113-1 Security update for dovecot24 SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15676-1 dovecot24-2.4.2-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:21159-1 Security update for dovecot24 SUSE / openSUSE Security Updates · Mar 23, 2026
- DSA-6019-1 dovecot - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2025-2439 Dovecot IMAP Server: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen und Offenlegung von Informationen BSI CERT-Bund (WID) · Dec 10, 2025